CLAMONACC(8)

✨ clamonacc — the Clam On-Access Scanner, bestie edition ✨

okay so real talk, this is the clamonacc(8) manual page from the Clam On-Access Scanner gang, and it's literally the antivirus bouncer that lives at your front door. let's get into it 💅

---

🌸 NAME 🌸

clamonacc — an anti-virus on-access scanning daemon and clamd client. yes she's both. multitasking queen 👑

---

🦋 SYNOPSIS 🦋

clamonacc [options]

that's it. that's the whole vibe. options only, no positional args, she doesn't want your random extra words 🙈

---

💖 DESCRIPTION 💖

so the clamonacc daemon signs up for file access notifications from the Linux kernel, and every time one of those notifications comes in, she submits scans to the clamd scanning daemon and waits for a verdict. that's the whole loop. it's giving security guard energy 🫶

On-Access is only available on Linux systems. not negotiable, not a suggestion. Linux only. periodt.

and on Linux, On-Access needs a kernel version >= 3.8. why? because it leverages a kernel api called fanotify to block processes from attempting to access malicious files. the blocking happens in kernel-space, which means it's stronger protection than a purely user-space solution could ever be. no cap, kernel-space is just built different 🔥

---

✨ OPTIONS ✨

• -h, --help — outputs the help info and dips. that's it, that's the job 💫
• -V, --version — prints the version number and exits.
• -v, --verbose — be verbose. give us the details, bestie.
• -l FILE, --log=FILE — saves the scan report to FILE.
• -F, --foreground — runs in the foreground; does not daemonize. she stays right there with you, in the group chat, not lurking in the background.
• -W FILE, --watch-list=FILE — watches the directories listed in FILE 👀
• -e FILE, --exclude-list=FILE — excludes the directories listed in FILE. not invited to the party, sorry.
• -p A[:I], --ping A[:I] — pings clamd up to [A] times, at an optional interval [I], until it responds. patient and persistent.
• -w, --wait — waits up to 30 seconds for clamd to start. optionally use this alongside ping to set the attempts [A] and interval [I] for checking on clamd. she'll wait for you, but only 30 seconds. she's not that down bad 😭
• --remove — removes infected files. > ⚠️ be careful. for real. that's the entire warning. be careful. files do not come back. 💀
• --move=DIRECTORY — moves infected files into DIRECTORY.
• --copy=DIRECTORY — copies infected files into DIRECTORY.
• -c FILE, --config-file=FILE — reads configuration from FILE.
• --allmatch — keeps scanning within the file after finding a match. no early exit, she's thorough 💅
• --fdpass — passes the file descriptor permissions to clamd. this is useful if clamd is running as a different user, since it's faster than streaming the file to clamd. only available if connected to clamd via local (unix) socket. (iykyk)
• --stream — forces file streaming to clamd. generally you do not need this, because clamdscan detects automatically if streaming is required. this option only exists for debugging and testing purposes, and in all other cases --fdpass is preferred. it's giving "legacy option we keep around for science" 🧚

---

🎀 SIGNALS 🎀

ClamOnAcc recognizes the following signals, and honestly she responds to all of them:

• SIGHUP — reopens the logfile. fresh page, new era ✨
• SIGUSR2 — reloads the signature databases. glow-up moment.
• SIGTERM — performs a clean exit. leaving the party politely, no drama, closing the door gently 🫶

---

🌈 FILES 🌈

• /etc/clamav/clamd.conf

---

⭐ CREDITS ⭐

please check the full documentation for credits. the whole squad is in there, we're not listing them twice 💜

---

👑 AUTHOR 👑

Tomasz Kojm <tkojm@clamav.net> — icon, legend, the moment.

---

💜 SEE ALSO 💜

• clamd.conf(5)
• clamd(8)

---

okay bestie that's the whole page, you ate it, no crumbs left 🌸

this was ClamAV 1.5.4, dated July 29, 2020, brought to you by the Clam On-Access Scanner girlies. now go scan something 💅💖