clamav cpanel plugin notify if infection found

jeffschips

• November 02, 2021 09:27

Hello. Wondering if it's possible to have cpanel clamav plugin install notify something anything whatever when it finishes the scan? Currently is just finishes without any notices whatsoever which is not very useful. I've installed eircar.com in various locations in my home directory to test it and 1) it doesn't seem to recognize it as found nor 2) do any notifications. I know the scan is running because ps | grep clam shows the process then it is gone a while later. Thanks.

• 

  cPanelAnthony

  • November 02, 2021 18:31

  Hello! While there's no innate way within cPanel to have a notification send every time a scan finishes regardless of results, it should be easy to configure a cronjob that does this. First, the following article should help with the base of the cronjob. Let me know if you have any questions.

  0
• 

  jeffschips

  • November 02, 2021 21:12

  thank you @cPanelAnthony A script I found that works but only when I manually run from the command line is this one:

  0
• 

  jeffschips

  • November 02, 2021 23:13

  Almost there: Made a tweak to the clamscan.sh file changing: clamscan -ri "$S" >> "$LOGFILE"; to /usr/local/cpanel/3rdparty/bin/clamscan -ri "$S" >> "$LOGFILE"; and now the process does not fail and proceeds. However, this introduces another problem. root 10104 1.4 31.7 1589716 1232960 ? Ssl Nov01 37:17 /usr/local/cpanel/3rdparty/bin/clamd -F root 23330 0.0 0.0 113280 780 ? Ss 19:04 0:00 /bin/sh -c /root/clamscan.sh > /dev/null 2>&1 root 23331 0.0 0.0 113284 936 ? S 19:04 0:00 /bin/bash /root/clamscan.sh root 23340 98.7 30.7 1303868 1191424 ? R 19:04 0:33 /usr/local/cpanel/3rdparty/bin/clamscan -ri /home/domain/public_html/ There appears to be two instances of clamscan.sh running

  0
• 

  cPanelAnthony

  • November 03, 2021 16:21

  Hello! I did some testing on my end using the exact same command and am only seeing one instance of ClamAV running. Could there be another cronjob running the clamscan? You can check with, crontab -l

  0
• 

  jeffschips

  • November 04, 2021 14:19

  I will check and report back. The only thing runing with the phrase "clam" is: /usr/local/cpanel/3rdparty/bin/freshclam --quiet --no-warnings

  0
• 

  cPanelAnthony

  • November 04, 2021 14:50

  Thank you for the heads up! I will await your response.

  0

Please sign in to leave a comment.