Quick start

This walks you from a freshly-built binary to a working scan. You’ll need exav installed first.

exav ships no signatures

exav never bundles the GPL-licensed ClamAV signature database. With no real signatures loaded, exav refuses to run rather than report clean on near-zero coverage. You fetch signatures yourself — that’s the first step below.

1. Get ClamAV signatures with Cisco’s own updater, onto your own machine:

   pip install cvdupdate
   cvd update                  # or `freshclam`

   This populates ~/.cvdupdate/database with main.cvd / daily.cvd / bytecode.cvd. See Signatures for the licensing background and third-party feeds.

2. Scan a file, pointing -d at that directory:

   exav -d ~/.cvdupdate/database suspicious.bin

   Output is clamscan-compatible:

   suspicious.bin: Win.Trojan.Agent-1234 FOUND

   or, for a clean file:

   suspicious.bin: OK

3. Scan a directory — recursive by default, printing only errors and detections:

   exav -d ~/.cvdupdate/database --quiet /var/www

4. Stream from stdin — constant memory, any size, no temp file:

   cat backup.tar.gz | exav -d ~/.cvdupdate/database -
   aws s3 cp s3://bucket/backup-50gb.tar.gz - | exav -d ~/.cvdupdate/database -

Understand the exit code

Each code is a status word, and the status is the last word on the result line:

Exit	Status	Meaning
0	OK	Clean — every file was fully scanned and nothing matched.
1	FOUND	At least one detection.
2	ERROR	exav could not do its job: an unreadable path, a database that would not load.
3	PARTIAL	exav worked, and something could not be fully examined — LIMITS-EXCEEDED, UNSCANNABLE or PASSWORD-PROTECTED.

Note

3 is the deliberate difference from clamscan, which reports OK and exits 0 for a file it could not fully scan. This is the never-silent-clean invariant in action: a CI job should treat 3 as “not a pass”, and 2 still means what it means in ClamAV — the scanner itself failed. To fold 3 into another status, see --partial-as.

Faster startup: build a database once

Loading Cisco’s raw ClamAV database (main.cvd+daily.cvd) builds a large in-memory automaton (tens of seconds, several GB of transient RAM). Do that work once and reuse it:

exav -d ~/.cvdupdate/database --build-db exav.exavdb   # heavy, run daily in CI
exav -d exav.exavdb /data                              # ~sub-second cold start

See the prebuilt database guide.

Run it as a daemon

Load the database once and serve scans over a socket, so callers pay no per-scan cold-start cost:

exav --listen /run/user/1000/exav.sock -d exav.exavdb   # load once, serve
exav --connect /run/user/1000/exav.sock /data           # client: no load cost
clamdscan --stream file.bin                    # the official ClamAV client works too

The direction is the flag: --listen accepts connections, --connect makes one. The protocol travels in the address, so --listen icap://0.0.0.0:1344 serves ICAP from the same binary — and naming both serves both from one process over one loaded database.

See the daemon guide.

Next

• Scanning — files, directories, output formats, exit codes.
• Migrating from ClamAV — replace clamscan / clamd in place.
• CLI reference — every flag.