antimalware:scanning

Configure the anti-malware scanning settings.

sentinel --task=antimalware:scanning
Option
 Value Default Description
--scan_hashtype <string> The hash algorithm for file-hash signature matching (stage 1). Controls which hash-based signatures are checked during scans. auto - use SHA-256 if CPU has hardware acceleration, sha256 - always use SHA-256 (requires sha256sum binary), md5 - always use MD5 (preserves performance on older CPUs without SHA-NI), both - run both MD5 and SHA-256 stages (maximum coverage, ~2x stage 1 time).
--scan_workers <auto|1-8> The number of parallel workers for native scan passes (MD5, SHA-256, HEX, and CSIG). Auto-detection uses 2 workers per CPU core, up to 8.
--scan_clamscan <auto|0-1> 1 Use ClamAV clamscan as the scan engine for improved performance on large file sets. ClamAV also handles YARA rule evaluation when native YARA scanning is not enabled. When set to "auto", LMD detects the clamscan binary at runtime and enables ClamAV scanning only if available.
--scan_yara <auto|0-1> Enable native YARA scanning via the yara binary (or yr from YARA-X). Supports YARA modules, compiled rules, and custom rule files that ClamAV cannot handle. When set to "auto", LMD enables native YARA scanning only when ClamAV is unavailable and a yara/yr binary is found — this prevents duplicate rule evaluation since ClamAV already processes YARA rules internally. To force native YARA alongside ClamAV, set to "1" and use scan_yara_scope to control which rules each engine handles.
--scan_yara_scope <custom|all> Controls which YARA rules the native YARA engine processes when both ClamAV and native YARA are enabled (scan_clamscan=1, scan_yara=1). This prevents double-scanning: ClamAV already evaluates YARA rules from rfxn.yara, so by default native YARA only processes custom rules that ClamAV cannot handle (modules, compiled rules, custom.yara.d/). all - scan all YARA rules natively (duplicates ClamAV YARA coverage), custom - only scan custom.yara + custom.yara.d/ natively (recommended). When ClamAV is disabled, this setting is ignored and all rules are scanned natively regardless of scope.
--scan_yara_timeout <digit> The timeout in seconds for YARA scan invocations. Set to 0 for no timeout.
--scan_csig <1|0> Enable compound signature (csig) scanning. Compound signatures support multi-pattern boolean logic (AND/OR/threshold), case-insensitive matching, wide (UTF-16LE) matching, and bounded gap wildcards. csig scanning runs in native mode only (not with ClamAV).
--scan_user_access <1|0> 0 Allows non-root users to perform scans. This must be enabled when using mod_security2 upload scanning or if you want to allow users to perform scans. When enabled, this will populate "pub/" with user owned quarantine, session and temporary paths to facilitate scans.
--scan_user_access_minuid <digit> The minimum UID for users when creating per-user scan directories with --mkpubpaths. Users with UID below this value are skipped.
--scan_max_depth <digit> 15 The maximum directory depth that the scanner will search, a value of 10-15 is recommended. (changing this may have an impact on scan performance)
--scan_min_filesize <digit> 24 The minimum file size in bytes for a file to be included in LMD scans. (changing this may have an impact on scan performance)
--scan_max_filesize <string> 2048k The maximum file size for a file to be included in LMD scans. Accepted value formats are b, k, M. When using the clamscan engine, the max_filesize will be dynamically set based on the largest known filesize from the MD5 hash signature file. (changing this may have an impact on scan performance)
--scan_hexdepth <digit> 65536 The maximum byte depth that the scanner will search into a files content. The default signature rules expect a depth size of at least 65536 bytes. (changing this may have an impact on scan performance)
--scan_hexfifo <1|0> 1 Use named pipe (FIFO) for passing file contents hex data instead of stdin default; improved performance and greater scanning depth. This is highly recommended and works on most systems. The hexfifo will be disabled automatically if for any reason it can not be successfully utilized.
--scan_hexfifo_depth <digit> 524288 The maximum byte depth that the scanner will search into a files content when using named pipe (FIFO). Improved performance allows for greater scan depth over default scan_hexdepth value. (changing this may have an impact on scan performance)
--scan_hex_chunk_size <digit> The maximum number of files processed per micro-batch during HEX+CSIG scanning. Valid range: 1024-20480. Values outside this range are clamped with a logged warning. To increase throughput, raise scan_workers instead. To reduce disk usage, lower scan_hexdepth instead. (changing this may have an impact on scan performance)
--scan_cpunice <int> 19 Process CPU scheduling (nice) priority level for scan operations. (-19 = high prio, 19 = low prio, default = 19)
--scan_ionice <digit> 6 Process IO scheduling (ionice) priority levels for scan operations. (0 = most favorable IO, 7 = least favorable IO)
--scan_cpulimit <digit> 0 Set hard limit on CPU usage for find and clam(d)scan processes. This requires the "cpulimit" binary to be available on the server. The values are expressed as relative percentage * N cores on system. An 8 CPU core system would accept values from 0 to 800, a 12 cores system would accept 0 to 1200 etc.
--scan_ignore_root <1|0> 1 As a design and common use case, LMD typically only scans user space paths and as such it makes sense to ignore files that are root owned. It is recommended to leave this enabled for best performance.
--scan_ignore_user <string1,string2> Ignore specific users from scans. This option should be used with care and is not ideal for ignoring false positives. Instead, you should use one of the ignore files.
--scan_ignore_user_add <string> Add a single entry to scan_ignore_user.
--scan_ignore_user_del <string> Remove a single entry from scan_ignore_user.
--scan_ignore_group <string1,string2> Ignore specific groups from scans. This option should be used with care and is not ideal for ignoring false positives. Instead, you should use one of the ignore files.
--scan_ignore_group_add <string> Add a single entry to scan_ignore_group.
--scan_ignore_group_del <string> Remove a single entry from scan_ignore_group.
--scan_find_timeout <digit> 0 The maximum amount of time, in seconds, that the "find" file list generation will run before it is terminated. All "find" results up to the point of termination will be fully scanned. If performing a full scan of all user paths on a large server, it is reasonable to expect the find operation may take a long time to complete and as such this feature may interfere.
--scan_export_filelist <1|0> 0 The daily cron "find" operation performed by LMD detects recently created/modified user files. This "find" operation can be especially resource intensive, and it may be desirable to persist the file list results so that other applications/tasks may make use of the results. When scan_export_filelist is enabled the most recent result set will be saved to "/usr/local/maldetect/tmp/find_results.last"
--scan_tmpdir_paths <string> /tmp /var/tmp /dev/shm Include the scanning of known temporary world-writable paths.
--default <yes> Reset all settings to their default values.
--default_option <option> Reset a specific setting to its default value.
--restart <yes> Restart the service after saving settings.

Examples

// set the scan_max_depth
sentinel --task=antimalware:scanning --scan_max_depth=20 --restart=yes

// reset scan_max_depth back to its default value
sentinel --task=antimalware:scanning --default_option=scan_max_depth --restart=yes

// reset all settings to their default values
sentinel --task=antimalware:scanning --default=yes --restart=yes

// keep scans out of the way of production traffic with low CPU and IO priority
sentinel --task=antimalware:scanning --scan_cpunice=19 --scan_ionice=7 --scan_cpulimit=100 --restart=yes

// scan with the ClamAV engine and let native YARA handle only the custom rules
sentinel --task=antimalware:scanning --scan_clamscan=1 --scan_yara=1 --scan_yara_scope=custom --restart=yes

Related Pages