clamd - an anti-virus daemon


   clamd [options]


   The  daemon  listens for incoming connections on Unix and/or TCP socket
   and scans files or directories on demand. It  reads  the  configuration
   from /etc/clamav/clamd.conf


   It's recommended to prefix clamd commands with the letter z (eg. zSCAN)
   to indicate that the command will be delimited by a NULL character  and
   that  clamd should continue reading command data until a NULL character
   is read. The null delimiter assures that the complete command  and  its
   entire  argument  will  be processed as a single command. Alternatively
   commands may be prefixed with the  letter  n  (e.g.  nSCAN)  to  use  a
   newline  character  as  the  delimiter.  Clamd  replies will honour the
   requested terminator in turn.  If clamd doesn't recognize the  command,
   or the command doesn't follow the requirements specified below, it will
   reply with an error message, and close the connection.

   Clamd recognizes the following commands:

   PING   Check the server's state. It should reply with "PONG".

          Print program and database versions.

   RELOAD Reload the virus databases.

          Perform a clean exit.

   SCAN file/directory
          Scan a file or a directory (recursively)  with  archive  support
          enabled  (if  not  disabled  in  clamd.conf).  A  full  path  is

   CONTSCAN file/directory
          Scan  file  or  directory  (recursively)  with  archive  support
          enabled and don't stop the scanning when a virus is found.

   MULTISCAN file/directory
          Scan  file  in  a  standard  way or scan directory (recursively)
          using multiple threads (to  make  the  scanning  faster  on  SMP

   ALLMATCHSCAN file/directory
          ALLMATCHSCAN  works  just  like  SCAN except that it sets a mode
          where scanning continues after finding a match within a file.

          It is mandatory to prefix this command with n or z.

          Scan a stream of data. The stream is sent to  clamd  in  chunks,
          after  INSTREAM,  on  the  same  socket on which the command was
          sent.   This  avoids  the  overhead  of  establishing  new   TCP
          connections  and  problems with NAT. The format of the chunk is:
          '<length><data>' where <length> is the  size  of  the  following
          data  in bytes expressed as a 4 byte unsigned integer in network
          byte  order  and  <data>  is  the  actual  chunk.  Streaming  is
          terminated  by  sending a zero-length chunk. Note: do not exceed
          StreamMaxLength as defined in clamd.conf, otherwise  clamd  will
          reply   with   INSTREAM   size  limit  exceeded  and  close  the

   FILDES It is mandatory to newline terminate  this  command,  or  prefix
          with n or z.

          This  command  only  works  on UNIX domain sockets.  Scan a file
          descriptor.  After  issuing  a  FILDES  command   a   subsequent
          rfc2292/bsd4.4  style packet (with at least one dummy character)
          is sent to clamd carrying the  file  descriptor  to  be  scanned
          inside  the  ancillary  data.  Alternatively the file descriptor
          may be sent in the same packet, including the extra character.

   STATS  It is mandatory to newline terminate  this  command,  or  prefix
          with n or z, it is recommended to only use the z prefix.

          Replies  with  statistics about the scan queue, contents of scan
          queue, and memory usage. The exact reply format  is  subject  to
          change in future releases.

          It  is  mandatory  to  prefix  this command with n or z, and all
          commands inside IDSESSION must be prefixed.

          Start/end a clamd  session.  Within  a  session  multiple  SCAN,
          INSTREAM,  FILDES,  VERSION,  STATS  commands can be sent on the
          same socket without opening new connections. Replies from  clamd
          will be in the form '<id>: <response>' where <id> is the request
          number (in ascii, starting from 1) and <response> is  the  usual
          clamd  reply.   The  reply  lines  have  same  delimiter  as the
          corresponding command had.   Clamd  will  process  the  commands
          asynchronously, and reply as soon as it has finished processing.

          Clamd  requires  clients to read all the replies it sent, before
          sending  more  commands  to  prevent   send()   deadlocks.   The
          recommended  way  to  implement  a client that uses IDSESSION is
          with non-blocking sockets, and a select()/poll() loop:  whenever
          send  would  block,  sleep  in  select/poll until either you can
          write more data, or read more replies.   Note  that  using  non-
          blocking  sockets  without  the select/poll loop and alternating
          recv()/send() doesn't comply with clamd's requirements.

          If clamd detects that a client has deadlocked,   it  will  close
          the   connection.   Note  that  clamd  may  close  an  IDSESSION
          connection too if you don't follow the protocol's  requirements.
          The  client  can  use  the  PING  command to keep the connection

          It is mandatory to prefix this command with either n or  z.   It
          is recommended to use nVERSIONCOMMANDS.

          Print  program  and database versions, followed by "| COMMANDS:"
          and a space-delimited list of supported commands.   Clamd  <0.95
          will  recognize this as the VERSION command, and reply only with
          their version, without the commands list.

          This command can be used as an easy way to check  for  IDSESSION
          support for example.


   STREAM Scan  stream  -  on this command clamd will return "PORT number"
          you should connect to and send data to  scan.  (DEPRECATED,  use
          INSTREAM instead)


          Start/end  a  clamd session which will allow you to run multiple
          commands per TCP session. (use IDSESSION instead)


   -h, --help
          Output help information and exit.

   -V, --version
          Print the version number and exit.

   -c FILE, --config-file=FILE
          Read configuration from FILE.


   Clamd recognizes the following signals:

   SIGHUP Reopen the logfile.

          Reload the signature databases.

          Perform a clean exit.




   Please check the full documentation for credits.


   Tomasz Kojm <>


   clamd.conf(5),    clamdscan(1),    freshclam(1),     freshclam.conf(5),

More Linux Commands

Tk_FontId(3) - accessor functions for fonts - Linux man page
Given a tkfont, Tk_FontId returns the token that should be selected into an XGCValues structure in order to construct a graphics context that can be used to dra

appdata2solv(1) convert application meta data into a solv fi
The appdata format contains metadata about application. It can be available both in repositories (for available applications) and in the installed system (for i

xprehashprinterlist(1x) - Recomputes the list of available p
xprehashprinterlist causes all Xprint servers to recompute (update) their lists of available printers, and update the attributes for the printers. The intended

tk_chooseDirectory(n) - pops up a dialog box for the user to
The procedure tk_chooseDirectory pops up a dialog box for the user to select a directory. The following option-value pairs are possible as command line argument

major(3) - manage a device number - Linux manual page.......
A device ID consists of two parts: a major ID, identifying the class of the device, and a minor ID, identifying a specific instance of a device in that class. A

siggetmask(3) - BSD signal API (Library - Linux man page)...
These functions are provided in glibc as a compatibility interface for programs that make use of the historical BSD signal API. This API is obsolete: new applic

fc-scan(1) - scan font files or directories - Linux man page
fc-scan scans file(s) recursively and prints out font pattern for each face found. OPTIONS This program follows the usual GNU command line syntax, with long opt

XtSetErrorHandler(3) - low-level error handlers (Man Page)
The XtError function has been superceded by XtAppError. The XtSetErrorHandler function has been superceded by XtAppSetErrorHandler. The XtSetWarningHandler func

XrmGetStringDatabase(3) - retrieve and store resource databa
The XrmGetFileDatabase function opens the specified file, creates a new resource database, and loads it with the specifications read in from the specified file.

MIME::Parser::Filer(3pm) - manage file-output of the parser
How this class is used when parsing When a MIME::Parser decides that it wants to output a file to disk, it uses its Filer object -- an instance of a MIME::Parse

journald.conf(5) Journal service configuration file.........
This file configures various parameters of the systemd journal service, systemd-journald.service(8). OPTIONS All options are configured in the [Journal] section

XkbSAGroup(3) - Returns the group_XXX field of act converted
XkbSAGroup returns the group_XXX field of act converted to a signed int. STRUCTURE Actions associated with the XkbGroupAction structure change the current group

We can't live, work or learn in freedom unless the software we use is free.