Install ClamAV Antivirus on VPS Linux

June 2026 · 8 min read

ClamAV is a free and open-source antivirus engine that is widely used for scanning Linux servers. It detects viruses, trojans, malware and other threats using a regularly updated signature database. ClamAV is ideal for VPS administrators who need basic security protection without consuming excessive system resources or requiring costly licenses.

Basic Requirements

Before installing ClamAV, ensure you have:

• A Linux VPS (CentOS, Ubuntu, Debian supported)
• Minimum 500MB free disk space for virus databases
• Root access or sudo privileges
• apt-get, yum, or another package manager installed

ClamAV Installation Steps

SSH into your VPS and run the following commands based on your operating system:

For Ubuntu/Debian:

sudo apt-get update
sudo apt-get install -y clamav clamav-daemon clamav-freshclam

For CentOS/RHEL:

sudo yum install -y epel-release
sudo yum install -y clamav clamav-daemon clamav-update

After installation completes, update the virus signature database:

sudo freshclam

This command downloads the latest virus definitions, which are essential for effective malware detection.

Configuring ClamAV

The main ClamAV configuration file is located at /etc/clamav/clamd.conf. Open it with your editor:

sudo nano /etc/clamav/clamd.conf

Find and modify these important settings:

LogFile /var/log/clamav/clamd.log
LogFileUnlock yes
MaxThreads 4
ScanMail yes
ScanArchive yes
ArchiveMaxRecursion 10

The MaxThreads value should match your VPS CPU cores. If you have 2 cores, set it to 2; if you have 4 cores, set it to 4. This balances scan speed with system performance.

Running Manual Scans

Before setting up automated cron jobs, test a manual scan:

clamscan -r /var/www/html

This command recursively scans all files in the /var/www/html directory (or your website root). The -r flag enables recursive scanning through subdirectories.

For faster scanning using the daemon that's already running:

sudo systemctl start clamav-daemon
sudo systemctl enable clamav-daemon
clamdscan -r /var/www/html

Using clamdscan instead of clamscan is 3-5 times faster because it connects to the running daemon instead of loading the entire engine fresh each time.

Setting Up Automated Cron Scans

To schedule automatic daily virus scans, create a cron job:

sudo crontab -e

Add this line to scan daily at 2:00 AM and email infected files only:

0 2 * * * clamscan -r -i /var/www/html 2>&1 | mail -s "ClamAV Scan Report" [email protected]

The -i flag means "infected only," which sends reports only for files with threats, preventing unnecessarily large emails.

To scan for all files including clean ones, remove the -i flag:

0 2 * * * clamscan -r /var/www/html 2>&1 | mail -s "ClamAV Full Scan" [email protected]

For CentOS systems, create a cron script instead:

sudo nano /etc/cron.daily/clamav-scan

Add this content:

#!/bin/bash
LOGDIR="/var/log/clamav"
LOG="$LOGDIR/daily-scan-$(date +\%Y\%m\%d).log"
mkdir -p $LOGDIR
clamscan -r -i /var/www/html > $LOG 2>&1
if [ -s $LOG ]; then
  mail -s "ClamAV Alert - Infected Files Found" [email protected] < $LOG
fi

Save the file and make it executable:

sudo chmod +x /etc/cron.daily/clamav-scan

Email Alerts and Notifications

To receive immediate alerts when malware is detected, create an advanced notification script:

sudo nano /usr/local/bin/clamav-notify.sh

Add this script:

#!/bin/bash
SCAN_DIR="/var/www/html"
EMAIL="[email protected]"
HOSTNAME=$(hostname)
DATE=$(date '+%Y-%m-%d %H:%M:%S')
LOG_FILE="/tmp/clamav-scan-$$.log"

# Run scan
clamscan -r $SCAN_DIR > $LOG_FILE 2>&1

# Check if infected files found
if grep -q "Infected files:" $LOG_FILE; then
  INFECTED=$(grep "Infected files:" $LOG_FILE)
  SUMMARY=$(tail -5 $LOG_FILE)

  {
    echo "ALERT: Malware detected on $HOSTNAME"
    echo "Time: $DATE"
    echo "Scan Directory: $SCAN_DIR"
    echo ""
    echo "$INFECTED"
    echo ""
    echo "Summary:"
    echo "$SUMMARY"
  } | mail -s "CRITICAL: Malware Found on $HOSTNAME" $EMAIL
fi

rm -f $LOG_FILE

Make the script executable:

sudo chmod +x /usr/local/bin/clamav-notify.sh

Add it to your crontab to run every 6 hours:

0 */6 * * * /usr/local/bin/clamav-notify.sh

This script scans every 6 hours and automatically sends an email alert if infected files are found.

FTP Server Integration

To scan files immediately after FTP upload, create a monitoring script:

sudo nano /usr/local/bin/ftp-scan.sh

#!/bin/bash
UPLOAD_DIR=$1
EMAIL="[email protected]"

clamscan -r "$UPLOAD_DIR" 2>&1 | tee /tmp/ftp-scan.log

if grep -q "Infected files:" /tmp/ftp-scan.log; then
  INFECTED=$(grep "Infected" /tmp/ftp-scan.log | head -5)

  {
    echo "FTP Upload Scan Alert"
    echo "Directory: $UPLOAD_DIR"
    echo ""
    echo "$INFECTED"
  } | mail -s "Malware in FTP Upload" $EMAIL

  # Optional: Remove infected files
  # find "$UPLOAD_DIR" -type f -name "*.php" -o -name "*.exe" | xargs clamscan | grep FOUND | cut -d: -f1 | xargs rm -f
  exit 1
fi
exit 0

Make it executable:

sudo chmod +x /usr/local/bin/ftp-scan.sh

For ProFTPD, add this to /etc/proftpd/proftpd.conf:

ScriptEngine on
ScriptLog /var/log/proftpd/script.log
ExecOnExit CDUP /usr/local/bin/ftp-scan.sh %p

Verify ClamAV is Working

Use these commands to verify ClamAV is installed and running correctly:

# Check version
clamscan --version

# Check daemon status
sudo systemctl status clamav-daemon

# Check freshclam status
sudo systemctl status clamav-freshclam

# View number of virus signatures
clamscan --version | grep -i "virus"

# Test with EICAR file (safe test file simulating a virus)
echo "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" > /tmp/eicar.txt
clamscan /tmp/eicar.txt

Troubleshooting Common Issues

Error: "Can't create temporary directory"

Cause: ClamAV's temporary folder lacks write permissions.

Solution:

sudo mkdir -p /var/tmp/clamav
sudo chown clamav:clamav /var/tmp/clamav
sudo chmod 755 /var/tmp/clamav

Error: "Socket file missing" when using clamdscan

Cause: The daemon is not running or the socket file was deleted.

Solution:

sudo rm -f /var/run/clamav/clamd.ctl
sudo systemctl restart clamav-daemon
sleep 2
clamdscan -r /var/www/html

Error: "freshclam: Connection timeout" or "Can't connect to ClamAV"

Cause: Firewall blocking the port or network connectivity issues.

Solution:

# Check network connectivity
ping -c 3 8.8.8.8

# Retry freshclam
sudo systemctl restart clamav-freshclam
sleep 5
sudo freshclam

# If still failing, change to a different mirror
sudo nano /etc/clamav/freshclam.conf
# Find DatabaseMirror and change to:
# DatabaseMirror clamav.net
# DatabaseMirror database.clamav.net

Scans are very slow or consuming 100% CPU

Cause: MaxThreads set too high or scanning large files.

Solution:

# Reduce thread count
sudo nano /etc/clamav/clamd.conf
# Change MaxThreads to 2 (for 2-core VPS)

# Scan only critical directories
clamscan -r --exclude-dir='^/sys' --exclude-dir='^/proc' /var/www/html

# Restart daemon
sudo systemctl restart clamav-daemon

Frequently Asked Questions

How much disk space does ClamAV use?

The initial virus database consumes approximately 100-150MB and grows daily with updates. Log files can consume 1-2GB per month if scanning frequently. It's recommended to set up log rotation to keep only the last 7-14 days of logs to manage disk space effectively.

How often should I scan?

For websites with frequent file uploads, daily scans (or every 12 hours) are recommended. For static websites with minimal changes, 1-2 scans per week is sufficient. For FTP uploads, real-time scanning immediately after upload is ideal to catch malware before it spreads.

Can ClamAV automatically remove infected files?

Yes, use the --remove flag in your clamscan command. Example: clamscan -r --remove /var/www/html. However, it's safer to quarantine files first using --move=/var/quarantine instead of deleting them. This allows manual review before permanent deletion, which is especially important for false positives.