ClamOnAcc not starting VirusEvent script, though virus is FOUND.
LinUser166 via clamav-users <[email protected]> Fri, 21 Mar 2025 10:34:41 +0100
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Message-ID | <[email protected]> |
ClamOnAcc not starting VirusEvent script, though virus is FOUND. I want Clamav to give me a notification on my desktop, if I download a file with a virus. For that purpose I have set up ClamOnAcc to monitor the Download folder and on VirusEvent to start a small script VDetected. For now VDetected just creates a file (TempTest). Later, the idea is, that it will notify my desktop. My problem is, that VDetected never get started even though clamonacc detects a new file in Download, sends the file to clamd for virus-test, and clamd finds the virus. I can see that in both the clamav.log and syslog file, after I have copied the EICAR-virus-test-file to Download. See the section "New lines in /var/log/clamav/clamav.log" far below. I have searched on a lot of Ubuntu and Clam forums, but now I am stuck and out of ideas. My system: --------------------------------- Kubuntu 24.04 LTS running on a virtual maschine called TestVM (Oracle VirtualBox 7.0.16). Filesystem: ext4 ClamAV version: 1.0.8 (OS: Linux, ARCH: x86_64, CPU: x86_64) My small script: /home/meuser/Documents/ClamTest/VDetected.sh -------------------------------- #! /bin/sh echo "Virus found" > /home/meuser/Documents/ClamTest/TempTest.txt clam.conf ------------------------------- LocalSocket /var/run/clamav/clamd.ctl FixStaleSocket true LocalSocketGroup clamav LocalSocketMode 666 # TemporaryDirectory is not set to its default /tmp here to make overriding # the default with environment variables TMPDIR/TMP/TEMP possible User clamav ScanMail true ScanArchive true ArchiveBlockEncrypted false MaxDirectoryRecursion 15 FollowDirectorySymlinks false FollowFileSymlinks false ReadTimeout 180 MaxThreads 12 MaxConnectionQueueLength 15 LogSyslog false LogRotate true LogFacility LOG_LOCAL6 LogClean false LogVerbose true PreludeEnable no PreludeAnalyzerName ClamAV DatabaseDirectory /var/lib/clamav OfficialDatabaseOnly false SelfCheck 3600 Foreground false Debug false ScanPE true MaxEmbeddedPE 10M ScanOLE2 true ScanPDF true ScanHTML true MaxHTMLNormalize 10M MaxHTMLNoTags 2M MaxScriptNormalize 5M MaxZipTypeRcg 1M ScanSWF true ExitOnOOM false LeaveTemporaryFiles false AlgorithmicDetection true ScanELF true IdleTimeout 30 CrossFilesystems true PhishingSignatures true PhishingScanURLs true PhishingAlwaysBlockSSLMismatch false PhishingAlwaysBlockCloak false PartitionIntersection false DetectPUA false ScanPartialMessages false HeuristicScanPrecedence false StructuredDataDetection false CommandReadTimeout 30 SendBufTimeout 200 MaxQueue 100 ExtendedDetectionInfo true OLE2BlockMacros false AllowAllMatchScan true ForceToDisk false DisableCertCheck false DisableCache false MaxScanTime 120000 MaxScanSize 100M MaxFileSize 25M MaxRecursion 16 MaxFiles 10000 MaxPartitions 50 MaxIconsPE 100 PCREMatchLimit 10000 PCRERecMatchLimit 5000 PCREMaxFileSize 25M ScanXMLDOCS true ScanHWP3 true MaxRecHWP3 16 StreamMaxLength 25M LogFile /var/log/clamav/clamav.log LogTime true LogFileUnlock false LogFileMaxSize 0 Bytecode true BytecodeSecurity TrustSigned BytecodeTimeout 60000 VirusEvent /home/meuser/Documents/ClamTest/VDetected.sh OnAccessMaxFileSize 50M OnAccessIncludePath /home/meuser/Downloads OnAccessExcludePath /home/meuser/Downloads/Old OnAccessExcludeUname clamav OnAccessPrevention no clamav.log ---------------------------------------------------- meuser@TestVM:~$ sudo cat /var/log/clamav/clamav.log [sudo] password for meuser: Tue Mar 18 21:59:45 2025 -> +++ Started at Tue Mar 18 21:59:45 2025 Tue Mar 18 21:59:45 2025 -> Received 2 file descriptor(s) from systemd. Tue Mar 18 21:59:45 2025 -> clamd daemon 1.0.8 (OS: Linux, ARCH: x86_64, CPU: x86_64) Tue Mar 18 21:59:45 2025 -> Log file size limited to 4294967295 bytes. Tue Mar 18 21:59:45 2025 -> Reading databases from /var/lib/clamav Tue Mar 18 21:59:45 2025 -> Not loading PUA signatures. Tue Mar 18 21:59:45 2025 -> Bytecode: Security mode set to "TrustSigned". Tue Mar 18 21:59:54 2025 -> Loaded 8705707 signatures. Tue Mar 18 21:59:57 2025 -> TCP: Received AF_INET6 SOCK_STREAM socket from systemd. Tue Mar 18 21:59:57 2025 -> LOCAL: Received AF_UNIX SOCK_STREAM socket from systemd. Tue Mar 18 21:59:57 2025 -> Limits: Global time limit set to 120000 milliseconds. Tue Mar 18 21:59:57 2025 -> Limits: Global size limit set to 104857600 bytes. Tue Mar 18 21:59:57 2025 -> Limits: File size limit set to 26214400 bytes. Tue Mar 18 21:59:57 2025 -> Limits: Recursion level limit set to 16. Tue Mar 18 21:59:57 2025 -> Limits: Files limit set to 10000. Tue Mar 18 21:59:57 2025 -> Limits: Core-dump limit is 0. Tue Mar 18 21:59:57 2025 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes. Tue Mar 18 21:59:57 2025 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes. Tue Mar 18 21:59:57 2025 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes. Tue Mar 18 21:59:57 2025 -> Limits: MaxScriptNormalize limit set to 5242880 bytes. Tue Mar 18 21:59:57 2025 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes. Tue Mar 18 21:59:57 2025 -> Limits: MaxPartitions limit set to 50. Tue Mar 18 21:59:57 2025 -> Limits: MaxIconsPE limit set to 100. Tue Mar 18 21:59:57 2025 -> Limits: MaxRecHWP3 limit set to 16. Tue Mar 18 21:59:57 2025 -> Limits: PCREMatchLimit limit set to 10000. Tue Mar 18 21:59:57 2025 -> Limits: PCRERecMatchLimit limit set to 5000. Tue Mar 18 21:59:57 2025 -> Limits: PCREMaxFileSize limit set to 26214400. Tue Mar 18 21:59:57 2025 -> Archive support enabled. Tue Mar 18 21:59:57 2025 -> AlertExceedsMax heuristic detection disabled. Tue Mar 18 21:59:57 2025 -> Heuristic alerts enabled. Tue Mar 18 21:59:57 2025 -> Portable Executable support enabled. Tue Mar 18 21:59:57 2025 -> ELF support enabled. Tue Mar 18 21:59:57 2025 -> Mail files support enabled. Tue Mar 18 21:59:57 2025 -> OLE2 support enabled. Tue Mar 18 21:59:57 2025 -> PDF support enabled. Tue Mar 18 21:59:57 2025 -> SWF support enabled. Tue Mar 18 21:59:57 2025 -> HTML support enabled. Tue Mar 18 21:59:57 2025 -> XMLDOCS support enabled. Tue Mar 18 21:59:57 2025 -> HWP3 support enabled. Tue Mar 18 21:59:57 2025 -> Self checking every 3600 seconds. Tue Mar 18 21:59:57 2025 -> Listening daemon: PID: 863 Tue Mar 18 21:59:57 2025 -> MaxQueue set to: 100 Tue Mar 18 22:08:07 2025 -> Client disconnected (FD 10) Tue Mar 18 22:08:07 2025 -> Client disconnected (FD 10) freshclam.log ---------------------------------------------------- meuser@TestVM:~$ sudo cat /var/log/clamav/freshclam.log [sudo] password for meuser: Tue Mar 18 21:59:46 2025 -> -------------------------------------- Tue Mar 18 21:59:46 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) Tue Mar 18 21:59:46 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) Tue Mar 18 21:59:46 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) Tue Mar 18 22:59:47 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) Tue Mar 18 22:59:47 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) Tue Mar 18 22:59:47 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) syslog (I have only included lines where "clam" occurs.) --------------------------------------------------- meuser@TestVM:~$ grep "clam" /var/log/syslog 2025-03-18T21:59:45.761235+01:00 TestVM systemd[1]: Starting clamav-daemon.socket - Socket for Clam AntiVirus userspace daemon... 2025-03-18T21:59:45.761254+01:00 TestVM systemd[1]: Listening on clamav-daemon.socket - Socket for Clam AntiVirus userspace daemon. 2025-03-18T21:59:45.761291+01:00 TestVM systemd[1]: Starting clamav-daemon.service - Clam AntiVirus userspace daemon... 2025-03-18T21:59:45.761462+01:00 TestVM systemd[1]: Started clamav-daemon.service - Clam AntiVirus userspace daemon. 2025-03-18T21:59:45.763385+01:00 TestVM kernel: systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked executable. Please remove executable permission bits. Proceeding anyway. 2025-03-18T21:59:45.763385+01:00 TestVM kernel: systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway. 2025-03-18T21:59:46.217078+01:00 TestVM systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked executable. Please remove executable permission bits. Proceeding anyway. 2025-03-18T21:59:46.217241+01:00 TestVM systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway. 2025-03-18T21:59:46.571325+01:00 TestVM systemd[1]: Started clamav-freshclam.service - ClamAV virus database updater. 2025-03-18T21:59:46.590585+01:00 TestVM freshclam[1185]: ClamAV update process started at Tue Mar 18 21:59:46 2025 2025-03-18T21:59:46.623086+01:00 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) 2025-03-18T21:59:46.623223+01:00 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) 2025-03-18T21:59:46.623286+01:00 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) 2025-03-18T21:59:57.081407+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: Global time limit set to 120000 milliseconds. 2025-03-18T21:59:57.081856+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: Global size limit set to 104857600 bytes. 2025-03-18T21:59:57.081962+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: File size limit set to 26214400 bytes. 2025-03-18T21:59:57.082183+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: Recursion level limit set to 16. 2025-03-18T21:59:57.082229+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: Files limit set to 10000. 2025-03-18T21:59:57.082246+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: Core-dump limit is 0. 2025-03-18T21:59:57.082259+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes. 2025-03-18T21:59:57.082270+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes. 2025-03-18T21:59:57.082293+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes. 2025-03-18T21:59:57.082305+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxScriptNormalize limit set to 5242880 bytes. 2025-03-18T21:59:57.082319+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes. 2025-03-18T21:59:57.082331+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxPartitions limit set to 50. 2025-03-18T21:59:57.082342+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxIconsPE limit set to 100. 2025-03-18T21:59:57.082360+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: MaxRecHWP3 limit set to 16. 2025-03-18T21:59:57.082377+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: PCREMatchLimit limit set to 10000. 2025-03-18T21:59:57.082391+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: PCRERecMatchLimit limit set to 5000. 2025-03-18T21:59:57.082402+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Limits: PCREMaxFileSize limit set to 26214400. 2025-03-18T21:59:57.082420+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Archive support enabled. 2025-03-18T21:59:57.082437+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> AlertExceedsMax heuristic detection disabled. 2025-03-18T21:59:57.082449+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Heuristic alerts enabled. 2025-03-18T21:59:57.082460+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Portable Executable support enabled. 2025-03-18T21:59:57.082477+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> ELF support enabled. 2025-03-18T21:59:57.082491+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Mail files support enabled. 2025-03-18T21:59:57.082502+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> OLE2 support enabled. 2025-03-18T21:59:57.082523+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> PDF support enabled. 2025-03-18T21:59:57.082541+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> SWF support enabled. 2025-03-18T21:59:57.082554+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> HTML support enabled. 2025-03-18T21:59:57.082566+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> XMLDOCS support enabled. 2025-03-18T21:59:57.082579+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> HWP3 support enabled. 2025-03-18T21:59:57.082605+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Self checking every 3600 seconds. 2025-03-18T21:59:57.082621+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> Listening daemon: PID: 863 2025-03-18T21:59:57.082632+01:00 TestVM clamd[863]: Tue Mar 18 21:59:57 2025 -> MaxQueue set to: 100 2025-03-18T22:08:07.160146+01:00 TestVM clamd[863]: Tue Mar 18 22:08:07 2025 -> Client disconnected (FD 10) 2025-03-18T22:08:07.160479+01:00 TestVM clamd[863]: Tue Mar 18 22:08:07 2025 -> Client disconnected (FD 10) Start of clamonacc ----------------------------------------------- meuser@TestVM:~$ sudo clamonacc --fdpass Status of the 2 daemons clamd and freshclam ----------------------------------------------- meuser@TestVM:~$ systemctl status clamav-daemon ● clamav-daemon.service - Clam AntiVirus userspace daemon Loaded: loaded (/usr/lib/systemd/system/clamav-daemon.service; enabled; preset: enabled) Drop-In: /etc/systemd/system/clamav-daemon.service.d └─extend.conf Active: active (running) since Tue 2025-03-18 21:59:45 CET; 1h 49min ago TriggeredBy: ● clamav-daemon.socket Docs: man:clamd(8) man:clamd.conf(5) https://docs.clamav.net/ Main PID: 863 (clamd) Tasks: 2 (limit: 4602) Memory: 1.5G (peak: 1.6G) CPU: 11.238s CGroup: /system.slice/clamav-daemon.service └─863 /usr/sbin/clamd --foreground=true meuser@TestVM:~$ systemctl status clamav-freshclam ● clamav-freshclam.service - ClamAV virus database updater Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; enabled; preset: enabled) Active: active (running) since Tue 2025-03-18 21:59:46 CET; 1h 51min ago Docs: man:freshclam(1) man:freshclam.conf(5) https://docs.clamav.net/ Main PID: 1185 (freshclam) Tasks: 1 (limit: 4602) Memory: 5.0M (peak: 5.5M) CPU: 12ms CGroup: /system.slice/clamav-freshclam.service └─1185 /usr/bin/freshclam -d --foreground=true mar 18 21:59:46 TestVM systemd[1]: Started clamav-freshclam.service - ClamAV virus database updater. mar 18 21:59:46 TestVM freshclam[1185]: ClamAV update process started at Tue Mar 18 21:59:46 2025 mar 18 21:59:46 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) mar 18 21:59:46 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) mar 18 21:59:46 TestVM freshclam[1185]: Tue Mar 18 21:59:46 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) mar 18 22:59:47 TestVM freshclam[1185]: Received signal: wake up mar 18 22:59:47 TestVM freshclam[1185]: ClamAV update process started at Tue Mar 18 22:59:47 2025 mar 18 22:59:47 TestVM freshclam[1185]: Tue Mar 18 22:59:47 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) mar 18 22:59:47 TestVM freshclam[1185]: Tue Mar 18 22:59:47 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) mar 18 22:59:47 TestVM freshclam[1185]: Tue Mar 18 22:59:47 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) EICAR-virus to Download folder ------------------------------------------------ EICAR-virus-test-file copied to /home/meuser/Downloads using the desktop GUI. (Happened before the next log-lines.) New lines in /var/log/clamav/clamav.log ----------------------------------------------- Tue Mar 18 23:08:07 2025 -> SelfCheck: Database status OK. Wed Mar 19 00:05:17 2025 -> /home/meuser/Downloads/eicar.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND Wed Mar 19 00:05:17 2025 -> Client disconnected (FD 10) Wed Mar 19 00:05:17 2025 -> /home/meuser/Downloads/eicar.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND Wed Mar 19 00:05:17 2025 -> Client disconnected (FD 10) New lines with clam in /var/log/syslog (grep "clam" /var/log/syslog) Two lines in the last half shows that the EICAR-test-file has been FOUND as I copied it to /home/meuser/Downloads ---------------------------------------------- 2025-03-18T23:08:07.235879+01:00 TestVM clamd[863]: Tue Mar 18 23:08:07 2025 -> SelfCheck: Database status OK. 2025-03-18T23:45:14.719125+01:00 TestVM systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked executable. Please remove executable permission bits. Proceeding anyway. 2025-03-18T23:45:14.722057+01:00 TestVM systemd[1]: Configuration file /etc/systemd/system/clamav-daemon.service.d/extend.conf is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway. 2025-03-18T23:59:48.478784+01:00 TestVM freshclam[1185]: Received signal: wake up 2025-03-18T23:59:48.479344+01:00 TestVM freshclam[1185]: ClamAV update process started at Tue Mar 18 23:59:48 2025 2025-03-18T23:59:48.514566+01:00 TestVM freshclam[1185]: Tue Mar 18 23:59:48 2025 -> daily.cld database is up-to-date (version: 27581, sigs: 2073928, f-level: 90, builder: raynman) 2025-03-18T23:59:48.514653+01:00 TestVM freshclam[1185]: Tue Mar 18 23:59:48 2025 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr) 2025-03-18T23:59:48.514681+01:00 TestVM freshclam[1185]: Tue Mar 18 23:59:48 2025 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman) 2025-03-19T00:05:17.993096+01:00 TestVM clamd[863]: Wed Mar 19 00:05:17 2025 -> /home/meuser/Downloads/eicar.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND 2025-03-19T00:05:17.993322+01:00 TestVM kernel: audit: type=1400 audit(1742339117.991:165): apparmor="DENIED" operation="exec" class="file" profile="/usr/sbin/clamd" name="/usr/bin/dash" pid=5476 comm="clamd" requested_mask="x" denied_mask="x" fsuid=120 ouid=0 2025-03-19T00:05:17.998773+01:00 TestVM kernel: audit: type=1400 audit(1742339117.996:166): apparmor="DENIED" operation="exec" class="file" profile="/usr/sbin/clamd" name="/usr/bin/dash" pid=5477 comm="clamd" requested_mask="x" denied_mask="x" fsuid=120 ouid=0 2025-03-19T00:05:18.001618+01:00 TestVM clamd[863]: Wed Mar 19 00:05:17 2025 -> Client disconnected (FD 10) 2025-03-19T00:05:18.001661+01:00 TestVM clamd[863]: Wed Mar 19 00:05:17 2025 -> /home/meuser/Downloads/eicar.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND 2025-03-19T00:05:18.001673+01:00 TestVM clamd[863]: Wed Mar 19 00:05:17 2025 -> Client disconnected (FD 10) This was a terrible lot of log-files showing that nearly everything works, except that no activity seen of my script VDetected. Any help will be appreciated, even just ideas to debug the problem further. Regards LinUser166 _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat