Clamd client(1) Clam AntiVirus Clamd client(1)
NAME
clamdscan - scan files and directories for viruses using Clam AntiVirus
Daemon
SYNOPSIS
clamdscan [options] [file/directory]
DESCRIPTION
clamdscan is a clamd client which may be used as a clamscan replace-
ment. It accepts all the options implemented in clamscan but most of
them will be ignored because its scanning abilities only depend on
clamd.
OPTIONS
-h, --help
Display help information and exit.
-V, --version
Print version number and exit.
-v, --verbose
Be verbose.
--quiet
Be quiet - only output error messages.
--stdout
Write all messages (except for libclamav output) to the standard
output (stdout).
-c, --config-file=FILE
Read clamd settings from FILE.
-l FILE, --log=FILE
Save the scan report to FILE.
-f FILE, --file-list=FILE
Scan files listed line by line in FILE.
-p A[:I], --ping A[:I]
Ping clamd up to [A] times at optional interval [I] until it re-
sponds.
-w, --wait
Wait up to 30 seconds for clamd to start. Optionally use along-
side ping to set attempts [A] and interval [I] to check clamd.
-m, --multiscan
Use multiscan mode. For local directory scans where the daemon
opens paths directly, clamd attempts to scan directory contents
in parallel using available threads. Single files are not af-
fected. When this option is combined with --stream, with --fd-
pass on a local socket, or with a quarantine action, clamdscan
walks the requested paths itself and submits individual file
scans while still allowing clamd to process multiple files in
parallel.
-z, --allmatch
After a match, continue scanning within the file for additional
matches.
--remove
Remove infected files. Be careful.
--move=DIRECTORY
Move infected files into DIRECTORY.
--copy=DIRECTORY
Copy infected files into DIRECTORY.
--no-summary
Do not display summary at the end of scanning.
--reload
Request clamd to reload virus database.
-i, --infected
Only print infected files
--fdpass
Open the file and pass the opened file descriptor to clamd. This
is useful if clamd is running as a different user or if clamd
sees a different filesystem tree. This is faster than streaming
the file to clamd. Only available if connected to clamd via
Unix/local socket.
--stream
Force clamdscan to send file contents to clamd instead of asking
clamd to open file paths. This is generally not needed because
clamdscan detects automatically if sending file contents is re-
quired. This option mostly exists for debugging and testing. In
other local-socket cases, --fdpass is usually preferred.
OPTION INTERACTIONS
clamdscan behavior depends first on the socket type, and then on com-
mand-line options.
Unix/local socket
By default, clamdscan asks the local daemon to open the paths
you provide. The daemon must be able to see those paths and have
permission to read them.
• With --fdpass, clamdscan opens each file itself and passes the
open file to the daemon. This is useful when the daemon runs
as a different user or sees a different filesystem view. This
option only works with a Unix/local socket and fd-passing sup-
port.
• With --stream, clamdscan sends file contents to the daemon in-
stead of asking the daemon to open paths.
• With --multiscan, directory scans can use multiple daemon
worker threads. If --stream, --fdpass, or a quarantine action
is also used, clamdscan walks the requested paths itself and
submits individual file scans while still allowing the daemon
to process multiple files in parallel.
• --allmatch is only effective when clamdscan is asking the dae-
mon to open paths directly and is not using --multiscan,
--stream, or --fdpass.
TCP socket
When the daemon is remote, clamdscan sends file contents instead
of local paths because client paths may not exist on the daemon
host. When the daemon is local and clamdscan can determine that
it is local, clamdscan may ask the daemon to open local paths
directly.
• --stream forces clamdscan to send file contents, even when the
daemon is local.
• --fdpass is not available over TCP. Use either --stream or
--fdpass for a scan, based on the socket type and how the dae-
mon can access the files.
• With --multiscan, local directory scans may use multiple dae-
mon worker threads. Remote scans, --stream scans, and scans
with quarantine actions are handled as individual file scans,
while still allowing the daemon to process multiple files in
parallel.
• --allmatch is only effective when clamdscan is asking a local
daemon to open paths directly and is not using --multiscan or
--stream.
Option guidance
--allmatch is not useful with --multiscan; use it only for scans
where clamdscan is asking a local daemon to open paths directly.
For quarantine, choose one action for a scan: --move, --copy, or
--remove.
Quarantine actions with multiscan
Quarantine actions such as --move, --copy, and --remove are per-
formed by clamdscan, not by clamd. For directory scans with
quarantine actions enabled, clamdscan resolves the action path
for each file before requesting the scan. When --multiscan is
also enabled, clamdscan submits individual file scans so it can
preserve the scan result to action-path association while still
allowing clamd to process multiple files in parallel.
EXAMPLES
(0) To scan a one file:
clamdscan file
(1) To scan a current working directory:
clamdscan
(2) To scan all files in /home:
clamdscan /home
(3) To scan a file when clamd is running as a different user:
clamdscan --fdpass ~/downloads
(4) To scan from standard input:
clamdscan - < file_to_scan
cat file_to_scan | clamdscan -
RETURN CODES
0 : No virus found.
1 : Virus(es) found.
2 : An error occurred.
CREDITS
Please check the full documentation for credits.
AUTHOR
Tomasz Kojm <tkojm@clamav.net>
SEE ALSO
clamd(8), clamd.conf(5), clamscan(1)
ClamAV 1.5.3 February 12, 2009 Clamd client(1)
Generated by dwww version 1.14 on Mon Aug 3 05:34:42 CEST 2026.