clamd.conf(5)

Hey bestie 💖 welcome to clamd.conf(5), aka the Clam AntiVirus daemon config manual — the whole thing, section 5, no skips, no shortcuts. This is the file that tells clamd(8) how to live its life. Grab a snack, we're going through every single directive. 🍓

---

✨ NAME ✨

clamd.conf — the configuration file for the Clam AntiVirus Daemon. That's it, that's the name, short and iconic. 👑

---

💅 DESCRIPTION 💅

clamd.conf is the file that configures the Clam AntiVirus daemon, clamd(8). She's the one in charge. Periodt.

---

🎀 FILE FORMAT 🎀

The file is made of two things: comments, and options with arguments. Simple as.

Any line that starts with a hash (#) symbol? The parser literally ignores it. Not even looking at it. 💀

Options and their arguments are case sensitive, and they're shaped like Option Argument.

The arguments come in these types, so let's do a little type tour 🦋:

• BOOL — a boolean value. You can write it as yes/no, or true/false, or 1/0. Pick your fighter.
• STRING — a string with no blank characters in it. No spaces, bestie, she's picky.
• SIZE — a size in bytes. You can use M or m for megabytes, and K or k for kilobytes. Want it in plain bytes? Just don't use any modifier. Easy.
• NUMBER — an unsigned integer.

---

🌈 DIRECTIVES 🌈

Okay so here's the vibe: when some option is not used — meaning it's commented out, or just straight up not in the config file at all — clamd takes a default action. So if you say nothing, she still has opinions. 💁

• Example — if this option is set, clamd will not run.

---

🌸 Logging & daemon basics 🌸

• LogFile STRING — save all reports to a log file.
  • Default: disabled
• LogFileUnlock BOOL — by default the log file is locked for writing, and only a single daemon process can write to it. This option disables that lock.
  • Default: no
• LogFileMaxSize SIZE — the maximum size of the log file. A value of 0 disables the limit entirely.
  • Default: 1048576
• LogTime BOOL — log the time for each message.
  • Default: no
• LogClean BOOL — log all clean files too. Super useful for debugging, but it drastically increases the log size, so watch out.
  • Default: no
• LogSyslog BOOL — use the system logger. (She can work together with LogFile, they're not jealous.)
  • Default: no
• LogFacility STRING — the type of syslog messages. Please refer to man syslog for facility names, iykyk.
  • Default: LOG_LOCAL6
• LogVerbose BOOL — enable verbose logging. Chatty era.
  • Default: no
• LogRotate BOOL — rotate the log file. Requires the LogFileMaxSize option to be set prior to this option, so order matters bestie.
  • Default: no
• ExtendedDetectionInfo BOOL — log additional info about the infected file — like its size and hash — right alongside the virus name. Extra details, extra slay.
  • Default: no
• PidFile STRING — write the daemon's pid to the specified file.
  • Default: disabled

---

🦋 Directories & databases 🦋

• TemporaryDirectory STRING — this option lets you change the default temporary directory.
  • Default: system specific (usually /tmp or /var/tmp).
• DatabaseDirectory STRING — this option lets you change the default database directory. If you enable it, please make sure it points to the same directory in both clamd and freshclam. Teamwork, fr fr.
  • Default: defined at configuration (/usr/local/share/clamav)
• CVDCertsDirectory STRING — path to a directory containing ClamAV CA certificate files, used to verify signed database archives (e.g. CVD files). This directory must already exist, be an absolute path, and be readable by freshclam, clamd, clamscan, and sigtool.
  • Default: /etc/clamav/certs
• FIPSCryptoHashLimits BOOL — enforce FIPS-like limits on using hash algorithms for cryptographic purposes. Will disable MD5 & SHA1 FP sigs, and will require .sign files to verify CVD authenticity.
  • Default: no
• OfficialDatabaseOnly BOOL — only load the official signatures published by the ClamAV project. Nothing unofficial gets in. 🚫
  • Default: no
• FailIfCvdOlderThan NUMBER — return with a nonzero error code if the virus database is older than the specified number of days.
  • Default: -1

---

🫶 Sockets & listening 🫶

• LocalSocket STRING — path to a local (Unix) socket the daemon will listen on.
  • Default: disabled
• LocalSocketGroup STRING — sets the group ownership on the unix socket.
  • Default: the primary group of the user running clamd
• LocalSocketMode STRING — sets the permissions on the unix socket to the specified mode.
  • Default: socket is world readable and writable
• FixStaleSocket BOOL — remove stale socket after an unclean shutdown. Cleanup queen. 🧹
  • Default: yes
• TCPSocket NUMBER — TCP port number the daemon will listen on.
  • Default: disabled
• TCPAddr STRING — by default clamd binds to INADDR_ANY. This option lets you restrict the TCP address and gives you some degree of protection from the outside world. This option can be specified multiple times in order to listen on multiple IPs. IPv6 is now supported. ✨
  • Default: disabled

---

👑 Protocol commands 👑

• EnableShutdownCommand BOOL — enables the SHUTDOWN command. Setting this to no prevents a client from stopping clamd via the protocol. When disabled, clamd responds to this command with COMMAND UNAVAILABLE.
  • Default: yes
• EnableReloadCommand BOOL — enables the RELOAD command. Setting this to no prevents a client from reloading the database. When disabled, clamd responds to this command with COMMAND UNAVAILABLE.
  • Default: yes
• EnableVersionCommand BOOL — enables the VERSION command. Setting this to no prevents a client from querying version information. When disabled, clamd responds to this command with COMMAND UNAVAILABLE.
  • Default: yes
• EnableStatsCommand BOOL — enables the STATS command. Setting this to no prevents a client from querying statistics. When disabled, clamd responds to this command with COMMAND UNAVAILABLE.
  • Default: yes
• MaxConnectionQueueLength NUMBER — the maximum length the queue of pending connections may grow to.
  • Default: 200

---

🔥 Streaming, threads & timeouts 🔥

• StreamMaxLength SIZE — close the STREAM session when the data size limit is exceeded. The value should match your MTA's limit for the maximum attachment size.
  • Default: 100M
• StreamMinPort NUMBER — the STREAM command uses an FTP-like protocol. This option sets the lower boundary for the port range.
  • Default: 1024
• StreamMaxPort NUMBER — this option sets the upper boundary for the port range.
  • Default: 2048
• MaxThreads NUMBER — maximum number of threads running at the same time.
  • Default: 10
• ReadTimeout NUMBER — this option specifies the time (in seconds) after which clamd should timeout if a client doesn't provide any data.
  • Default: 120
• CommandReadTimeout NUMBER — this option specifies the time (in seconds) after which clamd should timeout if a client doesn't provide any initial command after connecting. The default is set to 30 to avoid timeouts with TCP sockets when processing large messages. If using a Unix socket, the value can be changed to 5. Note: the timeout for subsequent commands, and/or data chunks, is specified by ReadTimeout.
  • Default: 30
• SendBufTimeout NUMBER — this option specifies how long to wait (in milliseconds) if the send buffer is full. Keep this value low to prevent clamd hanging.
  • Default: 500
• MaxQueue NUMBER — maximum number of queued items (including those being processed by MaxThreads threads). It's recommended to have this value at least twice MaxThreads if possible.

WARNING: you shouldn't increase this too much, to avoid running out of file descriptors. The following condition should hold: text MaxThreads*MaxRecursion + MaxQueue - MaxThreads + 6 < RLIMIT_NOFILE RLIMIT_NOFILE is the maximum number of open file descriptors (usually 1024), set by ulimit -n.

• Default: 100

• IdleTimeout NUMBER — this option specifies how long (in seconds) the process should wait for a new job.
  • Default: 30

---

🧚 Scanning behavior 🧚

• ExcludePath REGEX — don't scan files and directories matching REGEX. This directive can be used multiple times.
  • Default: disabled
• MaxDirectoryRecursion NUMBER — maximum depth directories are scanned at.
  • Default: 15
• FollowDirectorySymlinks BOOL — follow directory symlinks.
  • Default: no
• CrossFilesystems BOOL — scan files and directories on other filesystems.
  • Default: yes
• FollowFileSymlinks BOOL — follow regular file symlinks.
  • Default: no
• SelfCheck NUMBER — this option specifies the time intervals (in seconds) in which clamd should perform a database check.
  • Default: 600
• ConcurrentDatabaseReload BOOL — enable non-blocking (multi-threaded/concurrent) database reloads. This feature will temporarily load a second scanning engine while scanning continues using the first engine. Once loaded, the new engine takes over. The old engine is removed as soon as all scans using the old engine have completed. This feature requires more RAM, so this option is provided in case users are willing to block scans during reload in exchange for lower RAM requirements.
  • Default: yes

---

💜 Events & daemon lifecycle 💜

• VirusEvent COMMAND — execute a command when a virus is found. Use the following environment variables to identify the file and virus names: $CLAM_VIRUSEVENT_FILENAME, $CLAM_VIRUSEVENT_VIRUSNAME. In the command string, '%v' will also be replaced with the virus name.

Note: the '%f' filename format character has been disabled and will no longer be replaced with the file name, due to command injection security concerns. Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead. For the same reason, you should NOT use the environment variables in the command directly, but should use it carefully from your executed script.

• Default: disabled

• ExitOnOOM BOOL — stop the daemon when libclamav reports an out of memory condition.
  • Default: no
• AllowAllMatchScan BOOL — permit use of the ALLMATCHSCAN command.
  • Default: yes
• Foreground BOOL — don't fork into background. Stay right here, main character energy. ✨
  • Default: no
• Debug BOOL — enable debug messages from libclamav.
  • Default: no
• LeaveTemporaryFiles BOOL — do not remove temporary files (for debugging purpose).
  • Default: no
• GenerateMetadataJson BOOL — bestie, this one records metadata all about the file being scanned 📝. Scan metadata is lowkey essential for file analysis and for debugging why a scan is behaving the way it is. The JSON metadata gets printed out after the scan is complete if Debug is enabled. And a metadata.json file gets written to the scan temp directory if LeaveTemporaryFiles is enabled. Default: no
• JsonStoreHTMLURIs BOOL — stores the URIs it finds in HTML files into the json metadata ✨. They go in an array under the tag URIs. Heads up: GenerateMetadataJson is required for this feature to do literally anything. Default: yes (if GenerateMetadataJson is used)
• JsonStorePDFURIs BOOL — same vibe, but for URIs found in PDF files 🦋. They land in an array tagged URIs. And again: GenerateMetadataJson is required for this feature. Default: yes (if GenerateMetadataJson is used)
• JsonStoreExtraHashes BOOL — calculates MD5 and SHA1 hashes (on top of SHA2-256, not instead of) and stores them in the json metadata 💅. You guessed it: GenerateMetadataJson is required for this feature. Default: no
• User STRING — run the daemon as a specified user. Important: the process must be started by root for this to work at all. Default: disabled
• Bytecode BOOL — with this turned on, ClamAV loads bytecode from the database. Highly recommended you keep this on — otherwise you may miss detections for a whole bunch of new viruses 😭. Default: yes
• BytecodeSecurity STRING — sets the bytecode security level 🔒.

Possible values:

• TrustSigned — trust bytecode loaded from signed .c[lv]d files, and insert runtime safety checks for bytecode loaded from other sources
• Paranoid — don't trust any bytecode, insert runtime checks for all of it

Recommended: TrustSigned, because bytecode inside .cvd files already has these checks. Default: TrustSigned

• BytecodeTimeout NUMBER — sets the bytecode timeout, measured in milliseconds ⏱️. Default: 10000
• BytecodeUnsigned BOOL — allows loading bytecode from outside digitally signed .c[lv]d files.

Caution: you should NEVER run bytecode signatures from untrusted sources. Doing so may result in arbitrary code execution 💀. Like, actual "someone else runs code on your machine" energy. Do not play with this.

Default: no

• BytecodeMode STRING — sets the bytecode execution mode 🎛️.

Possible values:

• Auto — automatically choose JIT if possible, fallback to interpreter
• ForceJIT — always choose JIT, fail if that's not possible
• ForceInterpreter — always choose interpreter
• Test — run with both JIT and interpreter and compare the results. Makes all failures fatal.

Default: Auto

• DetectPUA BOOL — detect Possibly Unwanted Applications 🙈. Default: No
• ExcludePUA CATEGORY — excludes one specific PUA category. You can use this directive multiple times, stack 'em up 💅. The complete list of PUA categories lives at https://docs.clamav.net/faq/faq-pua.html. Default: disabled
• IncludePUA CATEGORY — only includes one specific PUA category. Also usable multiple times, no cap. Same list of categories at https://docs.clamav.net/faq/faq-pua.html. Default: disabled
• HeuristicAlerts BOOL — in some cases (like complex malware, exploits hiding in graphic files, and other cursed situations), ClamAV busts out special algorithms for accurate detection 🕵️. This option is what controls that algorithmic detection. Default: yes
• HeuristicScanPrecedence BOOL — lets a heuristic match take precedence 👑. When it's enabled, if a heuristic scan (like phishingScan) detects a possible virus/phishing, scanning stops immediately. Recommended — it saves CPU scan-time. When it's disabled, viruses/phishing caught by heuristic scans get reported only at the end of the scan. So if an archive holds both a heuristically detected virus/phishing and real malware, the real malware is what gets reported. Keep this disabled if you intend to handle "*.Heuristics.*" viruses differently from "real" malware. Oh, and heads up: if a non-heuristically-detected virus (signature-based) is found first, the scan is interrupted immediately regardless of this config option. Default: no
• ScanPE BOOL — PE means Portable Executable, the executable file format used across all 32 and 64-bit versions of Windows 🌈. This option lets ClamAV do a deeper analysis of executable files, and it's also required for decompressing popular executable packers like UPX. Turn it off and the original files still get scanned, just without the extra processing. Default: yes
• ScanELF BOOL — Executable and Linking Format is the standard format for UN*X executables 🐧. This option controls whether ELF files get scanned. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanMail BOOL — enables scanning of mail files 📧. Turn it off and the original files still get scanned, just without parsing individual messages/attachments. Default: yes
• ScanPartialMessages BOOL — scans RFC1341 messages that got split across many emails 😵. You'll need to periodically clean up the $TemporaryDirectory/clamav-partial directory.

WARNING: this option may open your system to a DoS attack. Never use it on loaded servers. Fr fr, just don't.

Default: no

• PhishingSignatures BOOL — enables email signature-based phishing detection 🎣. Default: yes
• PhishingScanURLs BOOL — enables URL signature-based phishing detection (Heuristics.Phishing.Email.*) 🔗. Default: yes
• StructuredDataDetection BOOL — enables the DLP module 🔍. Default: no
• StructuredMinCreditCardCount NUMBER — sets the lowest number of credit card numbers that must be found in a file before a detect is generated 💳. Default: 3
• StructuredCCOnly BOOL — with this on, the DLP module searches for valid credit card numbers only. Debit and Private Label cards won't be searched. Default: No
• StructuredMinSSNCount NUMBER — sets the lowest number of Social Security Numbers that must be found in a file before a detect is generated 🪪. Default: 3
• StructuredSSNFormatNormal BOOL — with this on, the DLP module searches for valid SSNs formatted as xxx-yy-zzzz. Default: Yes
• StructuredSSNFormatStripped BOOL — with this on, the DLP module searches for valid SSNs formatted as xxxyyzzzz. Default: No
• ScanHTML BOOL — performs HTML/JavaScript/ScriptEncoder normalisation and decryption 🌐. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanOLE2 BOOL — enables scanning of OLE2 files, like Microsoft Office documents and .msi files 📄. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanPDF BOOL — enables scanning within PDF files 📕. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanSWF BOOL — enables scanning within SWF files 🧚. Turn it off and the original files still get scanned, just without decoding and additional processing. Default: yes
• ScanXMLDOCS BOOL — enables scanning of xml-based document files supported by libclamav 📑. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanHWP3 BOOL — enables scanning of HWP3 files 🇰🇷. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanOneNote BOOL — enables scanning of OneNote files 📓. Turn it off and the original files still get scanned, just without additional processing. Default: yes
• ScanArchive BOOL — scans within archives and compressed files 🗜️. Turn it off and the original files still get scanned, just without unpacking and additional processing. Default: yes
• ScanImage BOOL — enables scanning of image (graphics) files 🖼️. Turn it off and the original files still get scanned, just without unpacking and additional processing. Default: yes
• ScanImageFuzzyHash BOOL — enables detection by calculating a fuzzy hash of image (graphics) files ✨. Signatures using image fuzzy hashes typically match files and documents by identifying images embedded in or attached to those files. Turn this off and some files may no longer be detected, which is giving "why is nothing firing" 😭. Default: yes
• AlertBrokenExecutables BOOL — alerts on broken executable files (PE & ELF) 💔. Default: no
• AlertBrokenMedia BOOL — alerts on broken graphics files (JPEG, TIFF, PNG, GIF) 🎀. Default: no
• AlertEncrypted BOOL — alerts on encrypted archives and documents (encrypted .zip, .7zip, .rar, .pdf) 🔐. Default: no
• AlertEncryptedArchive BOOL — alerts on encrypted archives (encrypted .zip, .7zip, .rar) 🗂️. Default: no
• AlertEncryptedDoc BOOL — alerts on encrypted documents (encrypted .pdf) 📄. Default: no
• AlertOLE2Macros BOOL — alerts on OLE2 files containing VBA macros (Heuristics.OLE2.ContainsMacros) 🦠. Default: no
• AlertExceedsMax BOOL — when this is set, files that exceed the MaxFileSize, MaxScanSize, or MaxRecursion limit get flagged with a virus name starting with "Heuristics.Limits.Exceeded" 🚨. Default: no
• AlertPhishingSSLMismatch BOOL — alerts on emails containing SSL mismatches in URLs. Careful though — this might lead to false positives! 🙈 Default: no

okay bestie we're still deep in the directives list and now we're hitting the scan-limit and on-access zone, so grab a snack 🍓, this part is a whole journey but I promise it's worth it 💖

---

• AlertPhishingCloak BOOL — turns on alerts for emails that are hiding cloaked URLs in them (heads up, this one might throw a few false positives, it's just like that sometimes 🙈). Default: no
• AlertPartitionIntersection BOOL — alerts when raw DMG image files have partition intersections going on. Default: no
• DisableCache — lets you turn off the engine's caching feature entirely. By default the engine keeps an MD5 in a cache for any file that didn't get flagged as a virus, or that hit its limit checks. > Warning: turning the cache off is gonna hurt performance on large scans, no cap, it's a real tradeoff 😭. Default: no
• CacheSize — sets how many entries the cache can hold. Bestie, the value should be a square number, otherwise it gets rounded up to the nearest square number (the math said so, not me ✨). Default: 65536
• ForceToDisk — makes memory or nested map scans dump their content to disk. Flip this on and more data gets written to disk, and it's available when the leave-temps option is enabled — but at the cost of more disk writes. Pick your battles 💅. Default: no
• MaxScanTime SIZE — the max amount of time a scan is allowed to take before it's done. The value is in milliseconds. Setting it to 0 disables the limit. > WARNING: disabling this limit or setting it too high may result in scanning of certain files locking up the scanning process/threads, which is literally a Denial of Service. That's not the vibe. Default: 120000
• MaxScanSize SIZE — the maximum amount of data scanned for each input file. Archives and other containers get recursively extracted and scanned up to this value. The size of the archive plus the sum of the sizes of all the files inside it both count toward the scan size. Like, a 1M uncompressed archive containing a single 1M inner file counts as 2M toward the max scan size — it's giving "everything counts" energy fr fr. > Warning: disabling this limit or setting it too high may result in severe damage to the system. Default: 400M
• MaxFileSize SIZE — files bigger than this limit just don't get scanned, periodt. This affects the input file itself and any files contained inside it (when the input file is an archive, a document, or some other kind of container). > Warning: disabling this limit or setting it too high may result in severe damage to the system. Also, technical design limitations prevent ClamAV from scanning files greater than 2 GB at this time. Default: 100M
• MaxRecursion NUMBER — nested archives get scanned recursively, so like if a Zip archive contains a RAR file, all the files within it get scanned too. This option says how deep the process should keep going. > Warning: setting this limit too high may result in severe damage to the system. Default: 17
• MaxFiles NUMBER — how many files get scanned inside an archive, a document, or any other kind of container. > Warning: disabling this limit or setting it too high may result in severe damage to the system. Default: 10000
• MaxEmbeddedPE SIZE — the max size of a file to check for embedded PE. Files bigger than this value skip that extra analysis step. Negative values are not allowed. Default: 40M
• MaxHTMLNormalize SIZE — the max size of an HTML file to normalize. HTML files bigger than this value don't get normalized or scanned. Negative values are not allowed. Default: 40M
• MaxHTMLNoTags SIZE — the max size of a normalized HTML file to scan. HTML files bigger than this value after normalization don't get scanned. Negative values are not allowed. Default: 8M
• MaxScriptNormalize SIZE — the max size of a script file to normalize. Script content bigger than this value doesn't get normalized or scanned. Negative values are not allowed. Default: 20M
• MaxZipTypeRcg SIZE — the max size of a ZIP file for reanalyzing type recognition. ZIP files bigger than this value skip the step that could potentially reanalyze them as PE. Negative values are not allowed. > WARNING: setting this limit too high may result in severe damage or impact performance. Default: 1M
• MaxPartitions SIZE — the maximum number of partitions of a raw disk image that get scanned. Raw disk images with more partitions than this value will have up to that many partitions scanned. Negative values are not allowed. > WARNING: setting this limit too high may result in severe damage or impact performance. Default: 50
• MaxIconsPE SIZE — the maximum number of icons within a PE that get scanned. PE files with more icons than this value will have up to that many icons scanned. Negative values are not allowed. > WARNING: setting this limit too high may result in severe damage or impact performance. Default: 100
• MaxRecHWP3 NUMBER — the maximum number of recursive calls to the HWP3 parsing function. HWP3 files using more than this limit get terminated and the user gets alerted. Scans will be unable to scan any HWP3 attachments if the recursive limit is reached. Negative values are not allowed. > WARNING: setting this limit too high may result in severe damage or impact performance. Default: 16
• PCREMatchLimit NUMBER — the maximum calls to the PCRE match function during an instance of regex matching. Instances using more than this limit get terminated and the user gets alerted, but the scan keeps going (iconic, honestly). For more info on match_limit, go look at the PCRE documentation. Negative values are not allowed. > WARNING: setting this limit too high may severely impact performance. Default: 10000
• PCRERecMatchLimit NUMBER — the maximum recursive calls to the PCRE match function during an instance of regex matching. Instances using more than this limit get terminated and the user gets alerted, but the scan keeps going. For more info on match_limit_recursion, see the PCRE documentation. Negative values are not allowed, and values greater than PCREMatchLimit are superfluous (like why would you 💀). > WARNING: setting this limit too high may severely impact performance. Default: 2000
• PCREMaxFileSize SIZE — the maximum filesize for which PCRE subsigs will be executed. Files exceeding this limit won't have PCRE subsigs executed, unless a subsig is encompassed to a smaller buffer. Negative values are not allowed. Setting this value to zero disables the limit. > WARNING: setting this limit too high or disabling it may severely impact performance. Default: 100M
• OnAccessIncludePath STRING — specifies a directory (including all the files and directories inside it) that should be scanned on access. This option can be used multiple times. Default: disabled
• OnAccessExcludePath STRING — lets you exclude directories from on-access scanning. It can be used multiple times. Default: disabled
• OnAccessExcludeRootUID BOOL — with this you can exclude the root UID (0). Processes running under root will be able to access all files without triggering scans or permission denied events. But bestie, note this: if clamd can't check the uid of the process that generated an on-access scan event (e.g., because OnAccessPrevention was not enabled, and the process already exited), clamd will perform a scan. So setting OnAccessExcludeRootUID is not guaranteed to prevent every access by the root user from triggering a scan (unless OnAccessPrevention is enabled). Default: no
• OnAccessExcludeUID NUMBER — lets you exclude specific UIDs. Processes with these UIDs will be able to access all files without triggering scans or permission denied events. This option can be used multiple times (one per line). Note: using a value of 0 on any line will disable this option entirely — so if you wanna exclude the root UID (0), please enable the OnAccessExcludeRootUID option instead. Also note: if clamd can't check the uid of the process that generated an on-access scan event (e.g., because OnAccessPrevention was not enabled, and the process already exited), clamd will perform a scan. Thus, setting OnAccessExcludeUID is not guaranteed to prevent every access by the specified uid from triggering a scan (unless OnAccessPrevention is enabled). Default: disabled
• OnAccessExcludeUname STRING — lets you do exclusions via user names when using the on-access scanning client. It can be used multiple times, and it has the same potential race condition limitations as the OnAccessExcludeUID option (yeah, that whole thing again 🙈). Default: disabled
• OnAccessMaxFileSize SIZE — files larger than this value won't be scanned in on access. Default: 5M
• OnAccessMaxThreads NUMBER — max number of scanning threads to allocate to the OnAccess thread pool at startup. These threads are the ones responsible for creating a connection with the daemon and kicking off scanning after an event has been processed. To keep clamonacc from consuming all of clamd's resources, keep this lower than clamd's max threads. Default: 5
• OnAccessCurlTimeout NUMBER — max amount of time (in milliseconds) that the OnAccess client should spend for every connect, send, and receive attempt when communicating with clamd via curl. Default: 5000 (5 seconds)
• OnAccessMountPath STRING — specifies a mount point (including all the files and directories under it) that should be scanned on access. This option can be used multiple times. Default: disabled
• OnAccessDisableDDD BOOL — turns OFF the dynamic directory determination system, aka the thing that lets clamd watch include paths recursively. If you kill DDD, no more recursive watch, bestie. Default: no
• OnAccessPrevention BOOL — switches on fanotify blocking, so when malicious files get caught, access gets blocked for real. Default: disabled
• OnAccessRetryAttempts NUMBER — how many times the OnAccess client will retry a scan that failed because of connection problems (or, like, other issues). Default: 0
• OnAccessDenyOnError BOOL — when you're using prevention, flipping this on means any error during scanning = the event attempt gets denied. Which sounds slay until you realize it can cause unwanted system behaviour with certain configurations 😭 so the client defaults it to off and would rather just allow access events if there's a scan or connection error. Default: no
• OnAccessExtraScanning BOOL — toggles extra scanning and notifications for when a file or directory is created or moved ✨. Heads up though: it requires the DDD system to kick off those extra scans. Default: no
• DisableCertCheck BOOL — disables authenticode certificate chain verification in PE files. Default: no

---

📝 NOTES 📝

Okay so real talk for a sec 🫶 — every option that expresses a size is capped at a max of 4GB. If you feed it values in excess of that, they get reset to the maximum. No negotiating, that's just the law.

---

📁 FILES 📁

• /etc/clamav/clamd.conf

---

👑 AUTHORS 👑

The masterminds behind all this, giving main character energy fr fr:

• Tomasz Kojm <tkojm@clamav.net>
• Kevin Lin <klin@sourcefire.com>

---

🦋 SEE ALSO 🦋

Go read these next, bestie, they're all in the same universe iykyk:

• clamd(8)
• clamdscan(1)
• clamav-milter(8)
• freshclam(1)
• freshclam.conf(5)

---

And that's the whole page, no cap 💅 ClamAV 1.5.4 dropped this one back on December 4, 2013, and that's the version and date you'd find sitting in the footer. Obsessed with you for reading the whole thing, mwah 🎀💖