Skip to content
exav

Quick start

This walks you from a freshly built binary to a working scan. You need exav installed first.

  1. Get ClamAV signatures with Cisco’s own updater:

    Terminal window
    pipx install cvdupdate
    cvd update

    This populates ~/.cvdupdate/database with main.cvd, daily.cvd and bytecode.cvd. See Signatures for the licensing background and third-party feeds.

  2. Tell exav where they are. exav loads --sig-dir (default /var/lib/exav) when -d is not given; point it at the new directory once for this shell:

    Terminal window
    export EXAV_SIG_DIR=~/.cvdupdate/database

    If freshclam already keeps a database current, use its directory instead (usually /var/lib/clamav).

  3. Check that detection works with the EICAR test file, which is harmless:

    Terminal window
    printf '%s%s' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-' \
      'TEST-FILE!$H+H*' > eicar.com
    exav eicar.com
    Terminal window
    eicar.com: Eicar-Test-Signature FOUND

    A SCAN SUMMARY block follows the result lines. This first run parses the raw signatures, which takes a while and needs memory to spare (see what it costs). If the process dies with no message, it ran out of memory. exav always knows EICAR, so the check that the ClamAV signatures loaded is Known viruses in the summary: it should be in the millions.

  4. Scan a file. The output follows clamscan’s format:

    Terminal window
    exav suspicious.bin
    Terminal window
    suspicious.bin: OK

  5. Scan a directory. It is recursive by default; --quiet prints only detections, partial results and errors:

    Terminal window
    exav --quiet /var/www

  6. Scan stdin with -:

    Terminal window
    cat backup.tar.gz | exav -

Exit codes

Section titled “Exit codes”

The status is the last word on each result line: 0 OK, 1 FOUND, 2 ERROR (exav could not do its job), 3 PARTIAL (something could not be fully examined, where clamscan would say OK). A CI job should not treat 3 as a pass. See which code a run exits with.

Faster startup: build a database once

Section titled “Faster startup: build a database once”

Loading the raw signatures parses millions of them on every start. Do it once and reuse the result:

Terminal window
exav --build-db exav.exavdb     # run daily, e.g. in CI
exav -d exav.exavdb /data       # fast cold start

Rebuild the .exavdb after upgrading exav if its format changed (the load says so). See the prebuilt database guide.

Run it as a daemon

Section titled “Run it as a daemon”

Load the database once and serve scans over a socket, so callers pay no per-scan load cost. The daemon stays in the foreground, so run the client from a second terminal:

Terminal window
exav --listen /tmp/exav.sock -d exav.exavdb    # load once, serve
exav --connect /tmp/exav.sock /data            # client

A daemon can also keep its signatures current itself, fetching from a mirror with --auto-update (a --features http build); see Signatures.

--listen accepts connections and --connect makes one. The protocol travels in the address: --listen icap://0.0.0.0:1344 serves ICAP, and naming both serves both from one process. ClamAV’s own clamdscan works too, given a clamd.conf whose LocalSocket or TCPSocket points at the daemon.

See the daemon guide.

Next

Section titled “Next”