ClamAV Setup: Linux Antivirus in 12 Steps [2026]

Malware poses a significant threat to Linux systems, often bypassing the outdated assumption that these systems are immune to viruses. A simple email attachment, an infected file in a shared folder, or a compromised plugin can easily introduce malware into a Linux environment. This risk escalates when Linux servers interact with Windows clients or handle file uploads from the internet, necessitating robust security measures to protect not only the kernel but also all downstream users.

ClamAV emerges as a vital solution in this landscape, offering an open-source antivirus engine that is both free and actively maintained by Cisco Talos. This tutorial provides a comprehensive guide to deploying ClamAV on Linux, detailing a twelve-step process that encompasses everything from installation to real-time alert forwarding into a Security Information and Event Management (SIEM) system. By the end of this guide, users will have a fully operational scanner, scheduled scans, on-access protection, and reliable mail-filtering integration.

What Is ClamAV, and Why Deploy It in 2026?

ClamAV is an open-source antivirus engine designed initially for scanning mail traffic, now maintained under the Cisco-Talos/clamav repository on GitHub. Its free usage policy is particularly beneficial for small and medium-sized businesses in Australia looking to enhance their cybersecurity without incurring additional costs. As of mid-2026, the stable release line is ClamAV 1.5.x, with version 1.5.2 being the latest patch. Cisco Talos has made significant updates to the software, ensuring that it remains effective against evolving threats.

While ClamAV does not aim to compete with comprehensive endpoint detection and response (EDR) platforms, it excels in signature and heuristic-based scanning of mail attachments, file uploads, and shared folders. This focused capability addresses a critical gap in many Linux server environments, where traditional antivirus solutions may be lacking.

Prerequisites: What You Need Before You Start

To successfully deploy ClamAV, users need root or sudo access on a Linux machine, along with some patience for the initial signature download. Here’s what you will need:

• A Linux server or VM running Ubuntu 22.04/24.04, Debian 12, or a RHEL-family distribution (Rocky Linux 9, AlmaLinux 9, or RHEL 9) with a functioning package manager (apt or dnf).
• Root or sudo privileges on that machine.
• At least 2 vCPUs and 2GB of RAM for a single-purpose scanning host, and 4GB or more if clamd will run alongside a mail server.
• A minimum of 5GB of free disk space for ClamAV binaries, the signature database, and log growth over time.
• Outbound HTTPS (port 443) access to ClamAV’s signature mirrors.
• Basic familiarity with systemd, cron, and editing plain-text configuration files.
• Optional: an existing Postfix mail server and/or a Wazuh deployment for later integration steps.

Step 1: Plan Where ClamAV Fits Your Security Stack

Before proceeding with installation, it’s essential to define ClamAV’s role within your security framework. Common deployment scenarios include:

1. A mail gateway scanning attachments before they reach inboxes.
2. A file server or upload endpoint scanning content as it arrives.
3. A scheduled compliance sweep of an entire filesystem.
4. A container-scanning step in a build pipeline.

Most organizations will implement multiple use cases, but starting with a single, clearly defined purpose simplifies troubleshooting.

Step 2: Install ClamAV on Linux (Ubuntu, Debian, and RHEL)

Installation varies slightly across distributions, but the core components remain consistent. For Ubuntu or Debian, execute the following commands:

sudo apt update
sudo apt install -y clamav clamav-daemon clamav-freshclam clamav-milter
sudo systemctl stop clamav-freshclam

For Rocky Linux, AlmaLinux, or RHEL 9, use:

sudo dnf install -y epel-release
sudo dnf install -y clamav clamav-update clamd clamav-milter
sudo cp /etc/clamd.d/scan.conf.sample /etc/clamd.d/scan.conf

Step 3: Verify the Installation and Check Versions

After installation, it’s crucial to verify that the binaries are correctly installed and to check the version. This step ensures that freshclam can download updates without issues:

clamscan --version
freshclam --version
clamd --version
systemctl status clamav-daemon clamav-freshclam --no-pager

Step 4: Configure freshclam for Automatic Signature Updates

Freshclam is responsible for keeping ClamAV’s signature database up to date. On Debian and Ubuntu, edit the configuration file:

sudo nano /etc/clamav/freshclam.conf

Remove the line that reads “Example” and ensure the key directives are set correctly. Run freshclam manually to check for connection errors before enabling the service.

Step 5: Configure the clamd Daemon and Enable the Services

With signatures downloading correctly, configure the daemon. On Debian/Ubuntu, edit:

sudo nano /etc/clamav/clamd.conf

Adjust the necessary directives, then enable and start both services:

sudo systemctl enable --now clamav-freshclam
sudo systemctl enable --now clamav-daemon

Step 6: Validate Detection With the EICAR Test File

To ensure that the security tool functions correctly, use the EICAR test file, which is universally recognized by antivirus engines:

echo 'X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt
clamscan /tmp/eicar.txt

Step 7: Run Manual Scans With clamscan and clamdscan

ClamAV provides two scanning commands: clamscan and clamdscan. The latter is significantly faster for repeated scans as it communicates with the running clamd daemon:

clamscan -r /var/www/uploads
clamdscan -m /var/www/uploads

Step 8: Automate Scanning With Cron Jobs

To ensure regular scans, set up cron jobs for essential directories. For example:

sudo crontab -e
30 2   * /usr/bin/clamdscan --multiscan --fdpass --log=/var/log/clamav/nightly-scan.log /home /var/www/uploads

Step 9: Enable On-Access Scanning With clamonacc

On-access scanning allows ClamAV to detect malware in real-time as files are modified or created. Configure this in clamd.conf and run clamonacc as a persistent process.

Step 10: Integrate ClamAV With Mail Servers and a SIEM

Integrating ClamAV with mail servers, particularly using the milter protocol, allows for scanning attachments before they reach users’ inboxes. Additionally, forwarding alerts to a SIEM enhances overall security visibility.

Step 11: Deploy ClamAV in Docker for Portable Scanning

For environments where direct installation is impractical, deploying ClamAV in a Docker container offers a flexible alternative. Ensure to mount the signature database on a named volume to maintain persistence across container restarts.

Step 12: Build a Complete Working ClamAV Project

To finalize the deployment, create a self-contained script that utilizes clamonacc for real-time detection and logs events for SIEM integration. This project encapsulates all previous steps into a cohesive security solution.

Common Pitfalls When Deploying ClamAV

Several common mistakes can hinder the effectiveness of ClamAV deployments, including:

• Skipping the initial freshclam run.
• Using clamscan for repeated scans instead of clamdscan.
• Failing to exclude virtual filesystems from scans.
• Blocking freshclam’s outbound access.
• Neglecting to re-test detection after configuration changes.

Troubleshooting ClamAV: Common Issues and Fixes

When issues arise, they are often related to:

• Freshclam download errors due to firewall settings.
• Connection issues with clamdscan.
• Permission errors on the clamd socket.

Performance Tuning and Advanced Tips

Once the deployment is stable, consider tuning parameters like MaxThreads and StreamMaxLength for optimal performance. Regularly check the signature database age to ensure timely updates.

ClamAV vs Commercial Antivirus and EDR Platforms

Understanding how ClamAV compares to commercial antivirus and EDR solutions is crucial. While ClamAV is free and excels in specific areas, it does not offer the comprehensive features of commercial products.

Frequently Asked Questions

Is ClamAV really free for commercial and business use?
Yes, ClamAV is open-source and does not charge for commercial deployment.

How often should freshclam update the signature database?
The default setting allows for updates approximately once an hour, which aligns with the frequency of new signature releases.

Does ClamAV replace the need for Microsoft Defender or a commercial EDR agent?
No, ClamAV should complement, not replace, existing endpoint protection solutions.

Can ClamAV scan Windows systems, not just Linux?
Yes, ClamAV is compatible with Windows and macOS, although this guide focuses on Linux deployments.

What’s the real difference between clamscan and clamdscan?
Clamscan reloads the signature database each time, while clamdscan communicates with the already-running clamd daemon for faster scans.