Best Practice for ClamAV Setup

Hello all!

I have some additional questions regarding my antivirus setup, as I’m
currently not entirely confident in how it’s configured. Here’s what I’ve
done so far:

   1.

   *Antivirus Installation and Updates:*
   I installed the antivirus software and enabled it. As far as I
   understand, the freshclam daemon updates the antivirus database
   automatically once a day. In my case, it runs at 10 a.m and I think this is
   OK for me.
   2.

   *Configuration Changes in clamd.conf:*
   I made the following changes to the clamd.conf file:
   - MaxScanSize: 50M (was 100M)
      - MaxFileSize: 10M (was 25M)
      - MaxRecursion: 8 (was 16)
      - ScanSWF: false (was true, I don't need to scan this type of files)
      - ScanHWP3: false (was true, I don't need to scan this type of files )
      - LogFileMaxSize: 10M (was 0)
      - MaxThreads: 8 (was 12)
      - MaxConnectionQueueLength: 10 (was 15)
      - IdleTimeout: 10 (was 30)
   3. Added a *whitelist of paths*:
      - ExcludePath ^/proc
      - ExcludePath ^/sys
      - ExcludePath ^/run
      - ExcludePath ^/dev
      - ExcludePath ^/snap
      - ExcludePath ^/var/lib
      - ExcludePath ^/var/ossec
      - ExcludePath ^/var/snap
      - ExcludePath \.png$
      - ExcludePath \.jpeg$
      - ExcludePath \.bmp$
      - ExcludePath \.mp3$
      - ExcludePath \.mp4$
      - ExcludePath \.log$
   4.

   *Scheduled Scans:*
   I plan to set up a cron job to perform weekly scans using the following
   command:

   bash
   сlamdscan --fdpass --log=/var/log/clamav/clamdscan.log
--move=/root/quarantine /

   5.

   *On-Access Scanning:*
   I decided against enabling on-access scanning because I’m concerned it
   might negatively impact the performance of our servers. This is something
   my admins are particularly worried about.

Questions:

   1.

   *What Should I Turn On or Turn OFF?*
   Are there any important configurations or features that I might have
   overlooked, either to enable or disable, for better performance or security?

To add more context, we need these for PCI DSS compliance.

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat