{"id":1053,"date":"2013-07-02T04:26:04","date_gmt":"2013-07-02T10:26:04","guid":{"rendered":"http:\/\/blog.supportpro.com\/?p=1053"},"modified":"2026-03-25T03:00:59","modified_gmt":"2026-03-25T09:00:59","slug":"automating-linux-anti-virus-using-clamav-and-cron","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/automating-linux-anti-virus-using-clamav-and-cron\/","title":{"rendered":"How to Automate ClamAV Virus Scans with Cron Jobs on Linux ?"},"content":{"rendered":"\n

Clam AntiVirus (ClamAV)<\/strong> is a free, open-source, cross-platform antivirus toolkit designed to detect various types of malware, including viruses and trojans. It is widely used on mail servers for scanning incoming emails and is compatible with multiple operating systems such as Linux, BSD, macOS, Solaris, and more.<\/p>\n\n\n\n

In this guide, we\u2019ll walk through how to install ClamAV and automate virus scanning using cron jobs on a Linux server (tested on Red Hat Enterprise Linux).<\/p>\n\n\n\n

Step 1: Install ClamAV<\/strong><\/h3>\n\n\n\n

Install ClamAV and required components using the package manager:<\/p>\n\n\n\n

yum install -y clamav clamav-db clamd<\/code><\/pre>\n\n\n\n
Start the ClamAV daemon:<\/p>\n\n\n\n
systemctl start clamd<\/code><\/pre>\n\n\n\n
\n
This setup also enables automatic virus definition updates using freshclam<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
Step 2: Create a Daily Cron Job for Scanning<\/strong><\/h3>\n\n\n\n
To automate scanning, create a script inside the cron daily directory:<\/p>\n\n\n\n
vi \/etc\/cron.daily\/clamscan_daily<\/code><\/pre>\n\n\n\n
Step 3: Add the Scan Script<\/strong><\/h3>\n\n\n\n
Paste the following script into the file:<\/p>\n\n\n\n
#!\/bin\/bash# Email configuration
EMAIL=\"alert@domain.com\"
SUBJECT=\"ClamAV Alert on $(hostname)\"# Log file
LOG=\"\/var\/log\/clamav\/daily_scan.log\"# Run ClamAV scan
clamscan -r \/ \\
--exclude-dir=\"^\/proc\" \\
--exclude-dir=\"^\/sys\" \\
--exclude-dir=\"^\/dev\" \\
--quiet \\
--infected \\
--log=$LOG# Check for infections
if grep -q \"Infected files: [1-9]\" $LOG; then
    MAILFILE=$(mktemp \/tmp\/clamav_alert.XXXXXX)    echo \"To: $EMAIL\" >> $MAILFILE
    echo \"From: alert@domain.com\" >> $MAILFILE
    echo \"Subject: $SUBJECT\" >> $MAILFILE
    echo \"\" >> $MAILFILE
    echo \"Malware detected on $(hostname). See details below:\" >> $MAILFILE
    echo \"\" >> $MAILFILE
    tail -n 50 $LOG >> $MAILFILE    sendmail -t < $MAILFILE
fi<\/code><\/pre>\n\n\n\n
Step 4: Set Proper Permissions<\/strong><\/h3>\n\n\n\n
Make the script executable:<\/p>\n\n\n\n
chmod +x \/etc\/cron.daily\/clamscan_daily<\/code><\/pre>\n\n\n\n
How It Works<\/strong><\/h3>\n\n\n\n