Maldet

The maldet command line options for the Linux Malware Detect. See /usr/local/maldetect/conf.maldet for more detailed information on how to use and configure this application.

maldet --help
Option Description
--scan-all PATH Scan all files in path (default: /home, wildcard: ?)
--scan-recent PATH DAYS Scan files changed in the last X days (default: 7d, wildcard: ?)
--file-list FILE Scan files or paths defined in line-spaced file
--background Execute scan operations in the background, ideal for large scans. May appear anywhere in the command line.
--include-regex REGEX Include paths/files based on POSIX extended regular expression (grep -E). May appear anywhere in the command line.
--exclude-regex REGEX Exclude paths/files based on POSIX extended regular expression (grep -E). May appear anywhere in the command line.
--config-option VAR=VALUE[,VAR=VALUE,...] Override conf.maldet config options at runtime
--user USER Run as specified user, for user quarantine or viewing user reports
--monitor USERS|PATHS|FILE|RELOAD Start inotify kernel-level file create/modify monitoring. USERS: monitor homedirs for UIDs >= inotify_minuid (default: 500). FILE: extract paths from line-spaced file. PATHS: comma-separated path list (no wildcards). RELOAD: trigger configuration reload on running monitor
--kill-monitor Terminate inotify monitoring service
--quarantine SCANID Quarantine all malware from scan report
--clean SCANID Try to clean & restore malware hits from scan report
--restore FILE|SCANID Restore file from quarantine to original path, or restore all items from a specific scan
--qd PATH Override the quarantine directory for this run. PATH must exist or the command exits with an error. May appear anywhere in the command line.
--list-active List active (running, paused, stale) scans with status info. Combine with --format for JSON or TSV output. Use --verbose for additional detail (workers, sig version, progress).
--kill SCANID Abort a running or paused scan. Writes an abort sentinel for cooperative shutdown, then sends SIGTERM (with SIGKILL fallback after 30s). Cleans scan-scoped temp files and updates meta to state=killed. Also handles stale scans (process already dead).
--pause SCANID [DURATION] Pause a running scan. Workers enter a sleep loop and external processes (clamscan, yara) receive SIGSTOP. Optional DURATION auto-resumes after the specified time: Ns (seconds), Nm (minutes), Nh (hours), or bare number (seconds). Without DURATION, the pause is indefinite until --unpause. Not supported for daemon ClamAV (clamdscan) scans.
--unpause SCANID Resume a paused scan. Removes the pause sentinel and sends SIGCONT to any stopped external processes.
--stop SCANID Checkpoint and stop a running or paused scan at the current stage boundary. Writes a checkpoint file preserving the scan state (stage, hits, options, sig version) for later resumption via --continue. Not supported for daemon ClamAV (clamdscan) scans.
--continue SCANID Resume a previously stopped scan from its checkpoint. Compares the current signature version with the checkpoint and warns if signatures have changed. Restores -co options from the checkpoint. Use --unpause for paused scans instead.
--maintenance Run maintenance tasks: rotate oversized history files (hits.hist, quarantine.hist, monitor.scanned.hist, inotify_log), clean up stale scan meta files, compress completed session files older than 1 hour, and archive sessions older than 30 days into monthly bundles (session.archive.YYMM.tsv.gz). Intended for cron or manual housekeeping.
--report [SCANID|list|latest|hooks|active] View scan report of most recent scan or of a specific SCANID. Use "latest" for most recent, "list" for all, "hooks" for hook scan activity, "active" for running scans. Requesting a SCANID that is still running shows active scan status instead. Combine with --format and --mailto.
--report hooks [--last DURATION] [--mode MODE] View hook scan activity log. DURATION: Nh (hours), Nd (days), Nm (minutes), default 24h. MODE: filter by hook mode (modsec, ftp, proftpd, exim, generic).
--all Show full scan history when used with -e list. Without --all, -e list shows only recent sessions. May appear anywhere in the command line.
--format text|json|html|tsv Set report output format for -e/--report and -L (default: text). May appear anywhere in the command line.
--mailto ADDRESS Email the report to the specified address instead of stdout. May appear anywhere in the command line.
--json-report [SCANID|list|newest] Shorthand for --report --format json. Output scan report as structured JSON (v1.2 schema: schema_version, scanner, host, reports[]). Supports both TSV and legacy plaintext sessions (legacy sessions include "source": "legacy"). Use "list" to output all session reports as a JSON array.
--alert-daily Generate a digest alert summarizing inotify monitor activity. Requires monitor mode to be running.
--digest Fire a unified digest alert reading all available sources: monitor session hits, hook scan hits, cleaned/suspended history. Does not require monitor mode — fires if any source has new data since the last digest. Cursors advance on read, preventing duplicate alerts.
--log View maldet event log
--update-sigs [--force] Update malware detection signatures from rfxn.com
--update-ver [--force|--beta] Update the installed version from rfxn.com
--cron-sigup Perform a signature update for the independent cron job. Internal use only — invoked by /etc/cron.d/maldet-sigup.
--purge Clear logs, quarantine queue, session and temporary data
--test-alert TYPE CHANNEL Send a test alert with synthetic data to verify alerting configuration. TYPE: scan (scan report with 3 synthetic hits) or digest (digest summary). CHANNEL: email, slack, telegram, or discord. Uses the real rendering pipeline with a [TEST] subject prefix. Channel isolation ensures only the specified channel receives the alert. Requires root privileges.
--checkout FILE Submit suspected malware to rfxn.com for review & signature hashing
--mkpubpaths Create per-user pub/ data directories for non-root scan operations. Requires scan_user_access=1 in conf.maldet.
--web-proxy IP:PORT Set HTTP/HTTPS proxy for all remote URL calls
--hook-scan Scan a single file supplied by a ModSecurity inspectFile hook. Used internally by hookscan.sh; not intended for direct invocation. May appear anywhere in the command line.
--version Show version information
--help Show this help message

Examples

// run a full background scan of all user home directories
maldet --scan-all /home --background

// scan files modified in the last 3 days in a specific web root
maldet --scan-recent /var/www/vhosts/example.com/httpdocs 3

// list the active scans and their status
maldet --list-active

// quarantine all malware found in a scan
maldet --quarantine 261007-030000-a1b2c3

// update the malware detection signatures
maldet --update-sigs

Related Pages