Ubuntu 22.04 Server / How to Install and Use ClamAV

To install ClamAV on Ubuntu 22.04 Server, install the clamav and clamav-freshclam packages, update the virus database, and then scan the desired files or directories using clamscan. This method performs scans on demand and does not enable real-time monitoring just by installation.

ClamAV and Preparation Before Scanning

ClamAV is a collection of open-source tools for detecting malware. freshclam updates the database used for detection, clamscan reads the database during execution to scan specified targets, and clamscan does not require the separate scan daemon clamd to be running.

This article is based on packages and systemd services for Ubuntu 22.04 Server. You need a network connection to access package repositories and signature databases, sudo permissions for installation, and sufficient disk space and memory for the database and scans. On production servers, run during idle times, considering the scope and load of scans.

Installing ClamAV

Update the package list and install the scanner and updater.

sudo apt update
sudo apt install clamav clamav-freshclam

After installation is complete, check the version and update service status.

clamscan --version
systemctl status clamav-freshclam --no-pager

If the service is running, it is configured to run automatic updates. If there is an error in the status or the service is missing, please refer to the updates and troubleshooting section below. The output varies depending on the installed version and database status.

Updating the signature database

You need an up-to-date database before scanning. If clamav-freshclam service is running, it updates in the background, so first check the status and recent records.

systemctl status clamav-freshclam --no-pager
journalctl -u clamav-freshclam -n 30 --no-pager

If manual updates are needed and the service is running, pause the service briefly before running to prevent both update processes from using the same logs or databases simultaneously.

sudo systemctl stop clamav-freshclam
sudo freshclam

Regardless of whether the update succeeds or fails, restart the service that was originally running and check its status. If the service was originally stopped, do not start it arbitrarily and follow the existing operational settings.

sudo systemctl start clamav-freshclam
systemctl status clamav-freshclam --no-pager

If a download fails or you receive a warning about an outdated version, check your internet, DNS, and proxy settings as well as the package update status. For explanations about request limits or errors, refer to ClamAV's FreshClam troubleshooting document.

Scanning files and directories

For example, to scan the current user's download directory including subdirectories, execute as follows. Replace it with the actual path you want to scan.

clamscan -r "$HOME/Downloads"

-r also scans subdirectories. To scan a single file, specify the file path as in clamscan /path/to/file. If there is a lot of output, you can add --infected to display only detected items.

clamscan -r --infected "$HOME/Downloads"

Files that the scanning account cannot read cannot be scanned, so check for permission errors. For areas requiring administrator privileges, such as /home which includes files from other users, you can scan after reviewing the permissions and impact using sudo clamscan -r /home. Scanning the entire file system takes a long time and may include other file systems, so check the scope first.

Reading Scan Results

Check the number of scanned files and Infected files at SCAN SUMMARY at the end of the output. Items with FOUND indicate detected files and detection names. If there were items that could not be scanned due to read errors or size limits, you cannot assume all files are safe even if the detection count is 0.

Immediately after the command, check the exit status with echo $?: 0 means no detections, 1 means detections, and 2 means an error. If another command is executed first, the value to check will change. Detailed options and exit statuses can be found in the Ubuntu 22.04 clamscan manual.

When Handling Detected Files

Since detections may be false positives, record the file path and detection name, and verify the purpose and source of the file. Immediately deleting important service files or user data can cause service interruptions or data loss. It is recommended to restrict access and follow your organization’s incident response procedures for further analysis and backup verification before taking action.

--move=DIRECTORY moves detected files to a specified directory, and --remove deletes them. Since both options modify the actual files, do not include them in a standard scan. If moving is necessary, first review a restricted quarantine location outside the scan range, write permissions, recovery methods, and service impacts. --copy creates a copy but keeps the original intact. ClamAV scanning documentation also recommend caution with automatic deletion due to the possibility of false positives.

When updates or scans fail

• database not found: Check the update service logs and network connection, and rescan once the database download is complete.
• log lock error: Check if another freshclam process is running. If you stopped the service during a manual update, restart it after the task.
• permission error or scan omission: Check file read permissions and error messages, and elevate permissions only as needed. Encrypted files or set size limits can also affect the scan range.

ClamAV is a useful detection tool, but there is no guarantee that it will find all malware. Use it along with regular updates, backups, and access control, and if real-time monitoring is needed, consider separate configuration and operational methods.