NAME

ClamdOmitScan.pl - High-speed anti-virus scanner for periodic scanning


SYNOPSIS

ClamdOmitScan.pl [options] [file/directory ...]

ClamdOmitScan.pl --maintain-scan-data [options]

ClamdOmitScan.pl --help|-h

ClamdOmitScan.pl --version|-V


DESCRIPTION

ClamdOmitScan.pl is a high-speed anti-virus scanner for periodic scanning.

When file or directory are omited, ClamdOmitScan.pl scans current directory.

ClamdOmitScan.pl scans files or directories by using clamd like clamdscan. But it behaves like clamscan. It accepts all the options implemented in clamdscan or clamscan. Though most of clamscan options will be ignored like clamdscan, it uses options more than clamdscan.

In addition, ClamdOmitScan.pl scans files or directories that has been scanned once at high speed. Because it omits the scanning of files which are not need to be scanned.

clamdscan can not connects to remote clamd. But ClamdOmitScan.pl can connect it. You can use anti-virus scan server on LAN. You need not install ClamAV in each client that uses ClamdOmitScan.pl.

NOTE: ClamdOmitScan.pl does not support stdin scanning it though clamscan supports it.


WHAT IS NECESSITY TO SCAN

ClamdOmitScan.pl inspects the following conditions before scanning a file.

C1. File Timestamp Condition
The file was modified or created after last scanned time.

C2. Scanner Version Condition
The version of current ClamAV and the version of it when the file was last scanned are different.

C3. Inspection Period Condition
The timestamp of the file is not older enough than the timestamp of last ClamAV which scanned it.

The file must be scanned If and only if C1 or (C2 and C3).

NOTE: Default enough period of C3 is 4 weeks. See --period option.


INET SOCKET

ClamdOmitScan.pl uses INET socket in the following cases.

* --socket is not specified.

* AND LocalSocket value is not specified in clamd.conf.

* AND --port is specified, or TCPSocket value is specified in clamd.conf.


STREAM CLAMD COMMAND

ClamdOmitScan.pl uses STREAM clamd command in the following cases.

* ClamdOmitScan.pl uses INET socket to connect to clamd.

* OR line-feed is included in the filename of the file to be scanned.


OPTIONS

ORIGINAL OPTIONS

--maintain-scan-data
Maintain scanning data. When this option is specified, ClamdOmitScan.pl does not scan.

--data directory | --data=directory
Path of scanning data directory. directory and directory.lock will be created if they don't exist.

DEFAULT: ~/.ClamdOmmitScan

--lock
Use exclusive lock for locking the scanning data. If this isn't specified, ClamdOmmitSca.pl uses shared lock. See flock(2).

--period seconds | --period=seconds
File inspection period. See WHAT IS NECESSITY TO SCAN.

DEFAULT: 2419200 (4 weeks)

--socket path
clamd UNIX domain socket path. When this option is specified, ClamdOmitScan.pl uses UNIX domain socket to connect to clamd.

When this option is not specified, ClamdOmitScan.pl uses LocalSocket value, if it is written in clamd.conf.

DEFAULT: /tmp/clamd.socket

--port port | --port=port
clamd INET socket (port number). When ClamdOmitScan.pl uses INET socket to connect to clamd, it uses this port as port number.

When this option is not specified, ClamdOmmitSca.pl uses TCPSocket value, if it is written in clamd.conf.

DEFAULT: (no)

--host address | --host=address
clamd server address.

When this option is not specified, ClamdOmmitSca.pl uses TCPAddr value, if it is written in clamd.conf.

DEFAULT: 127.0.0.1

--stream-max-length length | --stream-max-length=length
See clamd.conf(5)/StreamMaxLength.

When this option is not specfied, ClamdOmmitScan.pl uses StreamMaxLength value, if it is written in clamd.conf.

WARNING: ClamdOmitScan.pl might die when length is larger than the value clamd actually used. They are the following cases.

* ClamdOmitScan.pl uses STREAM clamd command.

* AND the size of the file to be scanned is larger than length.

See STREAM CLAMD COMMAND.

DEFAULT: 10M

--no-warn-unsupported
In the default, ClamdOmmitSca.pl warns about using unsuported options of clamscan. If this option is specified, it doesn't warns.

--error-unsupported
In the default, ClamdOmmitSca.pl warns about using unsuported options of clamscan. If this option is specified, it treats as a error.

--timeout seconds | --timeout=seconds
clamd connection timeout.

DEFAULT: 10

--scan-timeout seconds | --scan-timeout=seconds
Scan timeout par 1MB.

DEFAULT: 40

--bufsiz length | --bufsiz=length
When ClamdOmmitSca.pl uses STREAM clamd command or copies a infected file, it uses this value as read/write buffer size.

DEFAULT: 4096

--no-contscan
If this option is specified, ClamdOmmitSca.pl uses SCAN clamd commnand instead of CONTSCAN clamd command. See clamd(8)/SCAN and clamd(8)/CONTSCAN.

--perm-root octet | --perm-root=octet
Scanning data root directory permittion.

DEFAULT: 0700

--perm-dir octet | --perm-dir=octet
Directories permittion in scanning data directory.

DEFAULT: 0700

--perm-file octet | --perm-file=octet
Files permittion in scanning data directory.

DEFAULT: 0600

--perm-lock octet | --perm-lock=octet
Scanning data lock file permittion.

DEFAULT: 0600

--limit-timeout num | --limit-timeout=num
Frequency limitation of consecutive timeout. When clamd timeout occurred continualy num+1 or more times, ClamdOmitScan.pl stops if num is 0 or more.

Increase the value of --timeout or --scan-timeout when ClamdOmitScan.pl stops for this limitation though clamd operates normally.

DEFAULT: 3

--scan-rsrc
Scan a resource fork of each file on HFS filesystem.

This option requires perl module Sys::Filesystem.

DEFAULT: (no)

CLAMDSCAN OPTIONS

All clamdscan options are supported. See clamdscan(1) for detail.

CLAMSCAN OPTIONS

The following clamscan options are supported.

--recursive | -r
--max-dir-recursion
--exclude pattern | --exclude=pattern
--exclude-dir pattern | --exclude-dir=pattern
--include pattern | --include=pattern
--include-dir pattern | --include-dir=pattern
--infected
--copy directory | --copy=directory
--bell

See clamscan(1) for detail.


EXAMPLE

(0) Scan a single file:

ClamdOmitScan.pl file

(1) Scan a current working directory:

ClamdOmitScan.pl

(2) Scan all files (and subdirectories) in /home:

ClamdOmitScan.pl -r /home

(3) Use custom scanning data directory:

ClamdOmitScan.pl --data=/var/ClamdOmitScan/scanData

(4) Maintain custom scanning data directory:

ClamdOmitScan.pl --data=/var/ClamdOmitScan/scanData --maintain-scan-data


RETURN CODES

0: No virus found.

1: Virus(es) found.

2: Some errors occured.

40: Unknown option passed.

41: Bad options value passed.

42: Bad argument passed.

43: Unsupported option passed.

50: Error occured for scanning.

51: Error occured for maintenance scan data.


SEE ALSO

clamd(8), clamdscan(1), clamscan(1), flock(2), clamd.conf(5), Sys::Filesystem


AUTHOR

OKAMURA Yuji <https://sourceforge.jp/users/okamura/>