Where Does ClamAV Store Config, Signatures, and Logs?
Where ClamAV keeps its freshclam and daemon configs, signature databases, and scan logs on Linux.
Last updated
ClamAV splits its files three ways: configs in /etc/clamav, signature databases in /var/lib/clamav, logs in /var/log/clamav. Freshclam keeps the middle tree current; the scanner just reads it.
Most ClamAV mysteries resolve to one tree. Definitions outdated means freshclam never ran, permission denied means the daemon user cannot read the target, and a broken upgrade means a config option renamed. Check the trees in that order and the fix is usually obvious. The milter socket path only matters for mail setups.
Where ClamAV stores this, by platform
/etc/clamav
freshclam.conf and clamd.conf plus conf.d/ drop ins on some distros. The scanner runs as the clamav user, so config readability matters. Test edits with clamdcheckconf before restarting the daemon.
Frequently asked questions
where are clamav virus definitions stored
In /var/lib/clamav (main.cvd, daily.cvd, bytecode.cvd). Freshclam downloads them on its schedule; freshclam --show-progress runs it by hand. A stale daily file means the updater is broken, not the scanner. Never hand edit the .cvd files.
which clamav config files should i edit
Only freshclam.conf (mirror and update schedule) and clamd.conf (scan behavior). Leave the example commented blocks intact and add overrides below them. Package upgrades preserve both files but may add new .dpkg-dist copies to review.
where are clamav logs
In /var/log/clamav/ (freshclam.log and clamd.log typically). Permission errors on scan targets show here first. Logrotate manages the archives; a silent scanner usually has a full disk behind it.
Notice an outdated path? Let us know.