ClamAV - does not appear to be working
Posted: 14 Oct 2024, 19:37
Updated to 6.0.512. ClamAV 0.105.27
Some of this also relates to previous versions on Tos5.1.145
Looking at the 'report' function in GUI; only shows report dates for those scans performed manually (even if blank). No such reports for auto (eg daily) scans. I am aware that 'last/next run' are available but that does not give any value to previous runs.
There is no visual evidence for updates of the virus database (also set daily updates). In Tos5.1.145 I can see evidence of checks in the database
directory (or, at least, the linked directory in '@apps/ClamAV'); not so much in 6.0.512 (and previous). Last modification was Sept 29 when I think 0.105.27 was installed. Can you (arrange to) make a change in the settings layout to show database 'date/version' in use or similar and 'last update' date
In 6.0.145 I cannot make 'realtime protection' stay enabled. If enabled in GUI gets message 'Successful', but, if you close and reopen app it is now disabled again (or is it? at least the check-mark is gone.) This does not happen in 5.1.145 (although it may still not stay enabled between reboots as previously reported). At the same time I cannot see any visual evidence that it is actually scanning except the process 'ClamAV-amd64' is running (WHAT? amd? really?). No obvious spikes in load/cpu/memory/disk io (which might be a good thing from some viewpoints) Again some visual clue in the GUI would be helpful.
FYI, the 'scan folders' on my systems is set to '/'. I do note that ClamAV installs with root/root permissions, which is sort of odd given TM's feelings about 'root' usage. 
Some of this also relates to previous versions on Tos5.1.145
Looking at the 'report' function in GUI; only shows report dates for those scans performed manually (even if blank). No such reports for auto (eg daily) scans. I am aware that 'last/next run' are available but that does not give any value to previous runs.
There is no visual evidence for updates of the virus database (also set daily updates). In Tos5.1.145 I can see evidence of checks in the database
directory (or, at least, the linked directory in '@apps/ClamAV'); not so much in 6.0.512 (and previous). Last modification was Sept 29 when I think 0.105.27 was installed. Can you (arrange to) make a change in the settings layout to show database 'date/version' in use or similar and 'last update' date
In 6.0.145 I cannot make 'realtime protection' stay enabled. If enabled in GUI gets message 'Successful', but, if you close and reopen app it is now disabled again (or is it? at least the check-mark is gone.) This does not happen in 5.1.145 (although it may still not stay enabled between reboots as previously reported). At the same time I cannot see any visual evidence that it is actually scanning except the process 'ClamAV-amd64' is running (WHAT? amd? really?). No obvious spikes in load/cpu/memory/disk io (which might be a good thing from some viewpoints) Again some visual clue in the GUI would be helpful.
FYI, the 'scan folders' on my systems is set to '/'. I do note that ClamAV installs with root/root permissions, which is sort of odd given TM's feelings about 'root' usage.