大多数 ClamAV 指南都讨论了与 syslog 的集成,并且可以配置 syslog 以在某些日志上发送消息。但是,我的系统正在运行 systemd,没有活动的syslog.service
。我如何配置 ClamAV 以在此设置中发送有关威胁检测的消息?
答案1
我在 ClamAV 本身中没有找到配置设置,但是我确实找到了一个可以配置的脚本cron
(和一篇解释它的文章):
#!/bin/bash
# written by Tomas Nevar ([email protected])
# 17/01/2014 (dd/mm/yy)
# copyleft free software
#
LOGFILE="/var/log/clamav/clamav-$(date +'%Y-%m-%d').log";
HOST="$(hostname --long)";
EMAIL_MSG="Please see the log file attached.";
EMAIL_FROM="clamav-daily@"$HOST"";
EMAIL_TO="[email protected]";
DIRTOSCAN="/home";
# Check for mail installation
type mail >/dev/null 2>&1 || { echo >&2 "I require mail but it's not installed. Aborting."; exit 1; };
# Update ClamAV database
echo "Looking for ClamAV database updates...";
freshclam --quiet;
TODAY=$(date +%u);
if [ "$TODAY" == "6" ];then
echo "Starting a full weekend scan.";
# be nice to others while scanning the entire root
nice -n5 clamscan -ri / --exclude-dir=/sys/ &>"$LOGFILE";
else
DIRSIZE=$(du -sh "$DIRTOSCAN" 2>/dev/null|cut -f1);
echo -e "Starting a daily scan of "$DIRTOSCAN" directory.\nAmount of data to be scanned is "$DIRSIZE".";
clamscan -ri "$DIRTOSCAN" &>"$LOGFILE";
fi
# get the value of "Infected lines"
MALWARE=$(tail "$LOGFILE"|grep Infected|cut -d" " -f3);
# if the value is not equal to zero, send an email with the log file attached
if [ "$MALWARE" -ne "0" ]; then
echo "$EMAIL_MSG"|mail -a "$LOGFILE" -s "ClamAV: Malware Found" -r "$EMAIL_FROM" "$EMAIL_TO";
fi
echo "The script has finished.";
exit 0;
请注意,此脚本使用mailx
,因此需要稍微重新设计才能使此脚本与其他邮件代理(如)一起使用sendmail
。