Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In this thread it is discussed how to log a scan by ClamAV. However, the suggestions are only for logging one-off scans triggered from command line.

My situation is that I'm working in a setting where we have to comply with certain rules set forth by credit card companies etc. where two of the requirements are that a) we need to have scheduled, automatic AV scanning enabled, and b) we need to keep log files for at least one year.

I'm currently running ClamAV 0.97.8/18695 on Ubuntu 13.10 (upgraded all the way from 10.10) and the ClamTK GUI v5.05

I've defined daily scan (as well as daily update of signatures/AV definitions), but I cannot find any logs (my first guess was under /var/log/ ). Also, I can't find any clamscan config file where to define such things as logging.

Does anyone have ideas on how to enable automatic logging, and is there a major difference in the installation/config depending on whether ClamAV was installed with or without the ClamTK option? (I installed from Synaptic by selecting ClamTK and allowing apt to resolve dependencies/include what was needed, then I manually upgraded the GUI later from http://code.google.com/p/clamtk/ ).

Also, if anybody can answer how the scheduled of ClamTK is working, I'd appreciate it very much (I do realise it's a separate question, really). Grep'ing in /etc/cron./ doesn't show any hits on 'clam', so I wonder if ClamTK is using its own, custom scheduler or what is going on under the bonnet.

share|improve this question
    
How did you define a schedule? –  Seth Mar 26 at 23:48
    
The schedule was defined by opening ClamTK GUI app, then clicking Scheduler and setting a time using the 24 hour clock both for updating signatures and for scanning the computer. (I have previously used cron to start clamscan with the -l option to enable logging, and that's still possible. However I was assuming ClamTK to be able to replace the need for command line editing of cron etc., which I think is important to ensure adoption among non-tech users.) –  alfs Mar 27 at 8:20

1 Answer 1

up vote 1 down vote accepted

A couple of things:

1) ClamTk does not take any arguments like a commandline program would. Anything added after "clamtk" is assumed to be a file or directory for scanning.

2) ClamTk uses crontab for scheduling. Open a terminal window and type "crontab -l", and you'll see what you have scheduled. This should also appear in the GUI.

Hope this helps, Dave M

share|improve this answer
    
Thanks Dave, I'm indeed using crontab for scheduling and I have defined logging also from there (i.e. crontab -e). For some reason, I had problems making the GUI settings take effect, but it's now working (i.e. whenever I change through the GUI scheduler, the crontab is updated correctly). I'm now up to version 5.09 of the GUI. –  alfs Sep 15 at 9:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.