{"id":5089,"date":"2026-11-03T18:58:55","date_gmt":"2026-11-03T18:58:55","guid":{"rendered":"https:\/\/blog.mageia.org\/en\/?p=5089"},"modified":"2026-11-03T18:58:55","modified_gmt":"2026-11-03T18:58:55","slug":"potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia","status":"publish","type":"post","link":"https:\/\/blog.mageia.org\/en\/2026\/11\/03\/potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia\/","title":{"rendered":"Potions in Mageia. 06 \u2013 How to install and configure ClamAV as an antivirus in Mageia."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Foreword<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In many cases, we still cannot foresee the impact that the evolution of artificial intelligence will have on the evolution of humankind as a species inhabiting the Earth. Morals and values are genuinely under threat from this development, and given that humankind tends to lean towards the dark side with every discovery that could benefit progress, we are entering a new era of cyber-attacks and cybersecurity issues unlike anything we have seen before.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More than ever, the common sense of users of computer systems will play a major part in keeping their data secure and safe from attacks and unwanted blackmail. Furthermore, there is the resilience of the developers and maintainers of applications \u2013 in this case, open-source software for the Linux ecosystem and, consequently, for our Mageia distribution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Speaking personally, as a Mageia user since its inception, there are certain features in Mageia that have remained unchanged over time and which mean that I prefer to install Mageia on my computers over other distributions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Separation of the \u2018user\u2019 and \u2018system\u2019 partitions. This results in improved security and makes it easier to reinstall the system.<\/li>\n\n\n\n<li>Separation of \u2018administrator\/root\u2019 and \u2018user\u2019 passwords. Mageia continues to keep the \u2018sudo\u2019 option disabled by default during installation, which means you have to enter different passwords for both users.<\/li>\n\n\n\n<li>Security centre with a graphical interface. In the Mageia Control Centre, we have graphical security options that I haven\u2019t seen in other systems.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">And although Mageia can, for various reasons, be considered one of the most stable and secure distributions on the Linux scene, it never hurts to add a well-configured layer of security to our system. This is where ClamAv comes in \u2013 an antivirus programme that we can install from the repositories and, with the right configuration, use to further protect our personal files. So let\u2019s explain how to configure this antivirus programme, which offers real-time protection for Linux.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Installation<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Installing ClamAV is extremely straightforward in Mageia and can be done either via the software centre or via the command line in the terminal. But first, I\u2019d like to explain what we\u2019ll be installing:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ClamAV: Antivirus application; its database will be installed as a dependency.<\/li>\n\n\n\n<li>Clamd: Multi-process service for virus scanning.<\/li>\n\n\n\n<li>Clamtk: Graphical user interface for ClamAV for on-demand scanning.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To install these packages<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Software Centre: First, set all the filters in the Software Centre to \u2018All\u2019, then search for the packages mentioned above and install them.<\/li>\n\n\n\n<li>Terminal commands: Open a terminal as the \u2018root\u2019 user and install using: urpmi clamav clamd clamtk.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This completes the installation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Configuration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We have two options here: to leave ClamAV set to on-demand scanning, or to also configure real-time protection. So we\u2019ll explain both processes. But first of all, we need to enable the antivirus services for the next reboot in the Mageia Control Centre:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open the Mageia Control Centre.<\/li>\n\n\n\n<li>Go to the \u201cSystem\u201d section and then to \u201cManage system services by enabling or disabling them\u201d.<\/li>\n\n\n\n<li>Look for these services and enable the \u201cOn startup\u201d option:\n<ul class=\"wp-block-list\">\n<li>clamav-daemon: This is the antivirus engine. When active, scans are much faster because the database is already loaded into memory.<\/li>\n\n\n\n<li>clamav-freshclam: This is the service that keeps the signatures up to date in the background.<\/li>\n\n\n\n<li>clamav-clamonacc: Enables \u201cReal-time protection\u201d. Bear in mind that this uses more system resources and may slow down the opening of files (we\u2019ll look at how to configure this to optimize this later).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The sections in ClamTk:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Settings:\n<ul class=\"wp-block-list\">\n<li>Settings. To select the scan level required.<\/li>\n\n\n\n<li>Whitelist. Files included in the list will not be scanned.<\/li>\n\n\n\n<li>Network. Allows you to configure network and proxy options, etc.<\/li>\n\n\n\n<li>Scheduler. Allows you to schedule daily scans and definition updates.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>History:\n<ul class=\"wp-block-list\">\n<li>History. Allows you to view details of previous scans.<\/li>\n\n\n\n<li>Quarantine. Allows you to view files detected and placed in quarantine.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Updates:\n<ul class=\"wp-block-list\">\n<li>Update. To update virus definitions.<\/li>\n\n\n\n<li>Update Wizard. Configure definition updates, either manually or automatically.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Scan:\n<ul class=\"wp-block-list\">\n<li>Scan a file. Scans individual files.<\/li>\n\n\n\n<li>Scan a folder. Scans folders; by default, it opens the scan for the home folder.<\/li>\n\n\n\n<li>Scan. Allows you to check the previous scan results for a file or rescan it.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-gallery aligncenter has-nested-images columns-default is-cropped wp-block-gallery-2 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"984\" height=\"734\" data-attachment-id=\"5091\" data-permalink=\"https:\/\/blog.mageia.org\/en\/2026\/11\/03\/potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia\/potion_06_02\/\" data-orig-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02.jpg\" data-orig-size=\"984,734\" data-comments-opened=\"1\" data-image-title=\"Potion_06_02\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02.jpg\" data-id=\"5091\" src=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02.jpg\" alt=\"\" class=\"wp-image-5091\" srcset=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02.jpg 984w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02-300x224.jpg 300w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_02-768x573.jpg 768w\" sizes=\"auto, (max-width: 984px) 100vw, 984px\" \/><\/figure>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"> <br \/>In ClamTk, we select the \u2018Settings\u2019 option to choose the scan level we require. In my case, I have ticked all the boxes; this will make the process a little slower but may detect more threats, should there be any. Bear in mind that we\u2019ll then need to analyse any files found, as there may be false positives. For example, a spreadsheet containing macros might be flagged as suspicious, and the antivirus will recommend placing the files in quarantine so that we can review them later.<\/p>\n\n\n\n<figure class=\"wp-block-gallery aligncenter has-nested-images columns-default is-cropped wp-block-gallery-3 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"488\" data-attachment-id=\"5092\" data-permalink=\"https:\/\/blog.mageia.org\/en\/2026\/11\/03\/potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia\/potion_06_03\/\" data-orig-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03.jpg\" data-orig-size=\"1226,584\" data-comments-opened=\"1\" data-image-title=\"Potion_06_03\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03-1024x488.jpg\" data-id=\"5092\" src=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03-1024x488.jpg\" alt=\"\" class=\"wp-image-5092\" srcset=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03-1024x488.jpg 1024w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03-300x143.jpg 300w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03-768x366.jpg 768w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_03.jpg 1226w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>On-demand antivirus<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we only want to perform on-demand scans, we\u2019ll enable the two services mentioned above (clamav-daemon and clamav-freshclam), and from the ClamTk application we can perform on-demand scans of both folders and files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can also do this via the terminal using the following options:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>To scan a single file: clamscan \/path\/to\/file.txt<\/li>\n\n\n\n<li>To scan a folder: clamscan \/path\/to\/the\/folder<\/li>\n\n\n\n<li>To scan a folder and its subfolders: clamscan -r \/path\/to\/the\/folder<\/li>\n\n\n\n<li>You can find more scanning options in the <a href=\"https:\/\/docs.clamav.net\/manual\/Usage\/Scanning.html\"><strong>ClamAV documentation<\/strong><\/a>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Real-time protection<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ClamAv offers real-time protection on Linux. During installation, Mageia automatically creates the configuration file required to enable this option, but we\u2019ll look at how to configure the file to optimise scanning and system resources. For a home computer, we\u2019ll adjust a few settings whilst also configuring the paths on our computer that we wish to protect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><u>1. Enabling the clamav-clamonacc service<\/u><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firstly, if we haven\u2019t already done so, we\u2019ll enable the \u201cclamav-clamonacc\u201d service as described earlier in the Mageia Control Centre. After restarting the system, the necessary services should be up and running. We can check this from a terminal as root using the following command: \u201csystemctl &#8211;no-pager &#8211;full status clamav-daemon.service clamav-clamonacc.service clamav-freshclam\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><u>2. Creating the quarantine folder<\/u><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real-time protection service is configured to move suspicious files to the \/root\/quarantine folder. This folder is not created during installation (this will be reported to the relevant team to explore better integration for our users), so we must create it ourselves. The simplest way is to create it via the terminal in \u201croot\u201d mode using this command, which will also set the necessary permissions: \u201cinstall -d -o root -g root -m 700 \/root\/quarantine\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><u>3.- Configuring the \u201cclamd.conf\u201d file<\/u><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To complete the activation of real-time protection, we are going to modify the \u201cclamd.conf\u201d file located in \u201c\/etc\/\u201d. We can edit this file using any text editor; we\u2019ll try kwrite and Featherpad, which allow us to save the changes directly after entering the root password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To optimise resource usage, it is advisable to modify these settings; we can comment them out (this will disable the setting) or uncomment them (this will enable the setting) using \u201c#\u201d. Example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>#OnAccessExcludeUname clamav. This setting is disabled for the application.<\/li>\n\n\n\n<li>OnAccessExcludeUname clamav. This setting is enabled for the application (enabling it may change the value of the line).<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-4 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"465\" data-attachment-id=\"5093\" data-permalink=\"https:\/\/blog.mageia.org\/en\/2026\/11\/03\/potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia\/potion_06_04\/\" data-orig-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04.jpg\" data-orig-size=\"1098,499\" data-comments-opened=\"1\" data-image-title=\"Potion_06_04\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04-1024x465.jpg\" data-id=\"5093\" src=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04-1024x465.jpg\" alt=\"\" class=\"wp-image-5093\" srcset=\"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04-1024x465.jpg 1024w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04-300x136.jpg 300w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04-768x349.jpg 768w, https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_04.jpg 1098w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It is advisable to specify the folders you wish to monitor. This is done via the \u201cOnAccessIncludePath\u201d setting. The example provided is \u201cOnAccessIncludePath \/home\/\u201d. In our case, we have configured the following folders:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/home\/user\/Shared<\/li>\n\n\n\n<li>\/home\/user\/Downloads<\/li>\n\n\n\n<li>\/home\/user\/Documents<\/li>\n\n\n\n<li>\/home\/user\/Desktop<\/li>\n\n\n\n<li>\/home\/user\/Pictures<\/li>\n\n\n\n<li>\/home\/user\/Music<\/li>\n\n\n\n<li>\/home\/user\/Videos<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are the main folders in the user\u2019s personal home directory. They will cover most file movements. You can add many other paths, but bear in mind that this may increase resource usage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Following these guidelines will result in an initial file-optimisation configuration, but we encourage you to explore this further and share your experience with us in the comments section. With this configuration, RAM usage on various machines is around 1 GB \u2013 a figure that may seem excessive, but which, compared to other applications such as web browsers or Electron-based applications, is actually quite modest, bearing in mind that the scan is constantly running in the background.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><u>4. Final test and review<\/u><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once all the configuration is complete, we will carry out a test scan on a sample file. This test is known as EICAR; it was developed by the European Institute for Computer Antivirus Research and consists of a file used to check the extent of our antivirus scan and whether it is functioning correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, create a plain text file named \u201ceicar.txt\u201d and paste the following string of characters (without the quotation marks) into the file: \u201cX5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\u201d. You can save this file, for example, in the downloads folder; if the system is working correctly, the file will disappear and be moved to the quarantine folder at the path \u201c\/root\/quarantine\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After running the test, here is a summary of the checks:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check that the specified services are running from a terminal as root using \u201csystemctl &#8211;no-pager &#8211;full status \\ clamav-daemon.service clamav-clamonacc.service clamav-freshclam.service\u201d.<\/li>\n\n\n\n<li>Check the paths configured to be monitored by real-time protection.<\/li>\n\n\n\n<li>Check ClamAV\u2019s resource usage using the system\u2019s resource monitor.<\/li>\n\n\n\n<li>View the current status of clamonacc as root: systemctl cat clamav-clamonacc.service<\/li>\n\n\n\n<li>View recent messages from clamonacc as root: journalctl -u clamav-clamonacc.service -n 30 &#8211;no-pager<\/li>\n\n\n\n<li>View the clamonacc log as root: tail -n 40 \/var\/log\/clamav\/clamonacc.log<\/li>\n\n\n\n<li>Check the quarantine directory as root: ls -la \/root\/quarantine<\/li>\n\n\n\n<li>Check the monitored folders in the log as root: journalctl -u clamav-clamonacc.service -b \u2013no-pager<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">After checking the files in the quarantine, we can proceed to delete them using the file manager in administrator mode by navigating to the quarantine folder, or via the terminal as root using:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201ccd \/root\/quarantine\u201d: to navigate to the quarantine folder.<\/li>\n\n\n\n<li>\u201cls\u201d: to list the files in the folder.<\/li>\n\n\n\n<li>\u201crm filename\u201d to delete a specific file.<\/li>\n\n\n\n<li>\u201crm -f *\u201d: to delete all the contents of the folder.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This completes the configuration of our antivirus for Mageia, installed and updated from the official repositories, with real-time protection and on-demand scanning via the ClamTk graphical interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We hope this new potion will help you boost the security of your Mageia system!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Foreword In many cases, we still cannot foresee the impact that the evolution of artificial intelligence will have on the evolution of humankind as a species inhabiting the Earth. Morals and values are genuinely under threat from this development, and &hellip; <a href=\"https:\/\/blog.mageia.org\/en\/2026\/11\/03\/potions-in-mageia-06-how-to-install-and-configure-clamav-as-an-antivirus-in-mageia\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":38,"featured_media":5096,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[157,47,124,159,1,118],"tags":[],"class_list":["post-5089","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-atelier","category-community","category-mageia-2","category-security","category-uncategorized","category-users"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p159kA-1k5","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/blog.mageia.org\/en\/wp-content\/uploads\/2026\/11\/Potion_06_image_En-scaled.jpg","_links":{"self":[{"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/posts\/5089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/comments?post=5089"}],"version-history":[{"count":6,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/posts\/5089\/revisions"}],"predecessor-version":[{"id":5100,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/posts\/5089\/revisions\/5100"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/media\/5096"}],"wp:attachment":[{"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/media?parent=5089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/categories?post=5089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mageia.org\/en\/wp-json\/wp\/v2\/tags?post=5089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}