I'm currently running ClamAV in a debian docker container. I've enabled LogSyslog in the clamd.conf and freshclam.conf files. For some reason the log output isn't appending the app-name, procid, nor msgid to the front of the logs. Any idea why this is? I need that metadata so my SEIM can decode the logs correctly. I'm rather green, so please pardon my ignorance. Thank you. A sample of my freshclam.log file below -
Mon Aug 19 22:20:36 2019 -> -------------------------------------- Mon Aug 19 22:20:36 2019 -> Current working dir is /var/lib/clamav Mon Aug 19 22:20:36 2019 -> freshclam daemon 0.100.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64) Mon Aug 19 22:20:36 2019 -> Max retries == 5 Mon Aug 19 22:20:36 2019 -> ClamAV update process started at Mon Aug 19 22:20:36 2019 Mon Aug 19 22:20:36 2019 -> Using IPv6 aware code Mon Aug 19 22:20:36 2019 -> Querying current.cvd.clamav.net Mon Aug 19 22:20:36 2019 -> TTL: 1800 Mon Aug 19 22:20:36 2019 -> Software version from DNS: 0.101.3 Mon Aug 19 22:20:36 2019 -> WARNING: Your ClamAV installation is OUTDATED! Mon Aug 19 22:20:36 2019 -> WARNING: Local version: 0.100.2 Recommended version: 0.101.3 Mon Aug 19 22:20:36 2019 -> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav Mon Aug 19 22:20:36 2019 -> main.cvd version from DNS: 58 Mon Aug 19 22:20:36 2019 -> main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr) Mon Aug 19 22:20:36 2019 -> daily.cvd version from DNS: 25546 Mon Aug 19 22:20:36 2019 -> daily.cld is up to date (version: 25546, sigs: 1727460, f-level: 63, builder: raynman) Mon Aug 19 22:20:36 2019 -> bytecode.cvd version from DNS: 330 Mon Aug 19 22:20:36 2019 -> bytecode.cld is up to date (version: 330, sigs: 94, f-level: 63, builder: neo) Mon Aug 19 22:20:36 2019 -> --------------------------------------
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
