LogLevel

{logging level}

Logging level of the component.

If a parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Component executable path.

Default value:

•for GNU/Linux: /opt/drweb.com/bin/drweb-clamd

•for FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-clamd

Start

{logical}

The component is started by the Dr.Web ConfigD configuration management daemon.

Setting the value of this parameter to Yes instructs the configuration daemon to start the component immediately, and setting the value of this parameter to No—to shut down the component immediately.

Default value: No

Endpoint.<tag>.ClamdSocket

{IP address | UNIX socket}

Defines a mount point named <tag> and a socket (IPv4 address or a UNIX socket address) for clients who need to scan files for threats.

Only one socket can be specified for one <tag> point.

Default value: not set

[Endpoint.<tag>.]DetectSuspicious

{logical}

Inform about suspicious files detected by the heuristic analyzer.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: Yes

[Endpoint.<tag>.]DetectAdware

{logical}

Inform about files containing adware.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: Yes

[Endpoint.<tag>.]DetectDialers

{logical}

Inform about files containing dialers.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: Yes

[Endpoint.<tag>.]DetectJokes

{logical}

Inform about files containing jokes.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: No

[Endpoint.<tag>.]DetectRiskware

{logical}

Inform about files containing riskware.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: No

[Endpoint.<tag>.]DetectHacktools

{logical}

Inform about files containing hacktools.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: No

[Endpoint.<tag>.]ReadTimeout

{time interval}

Time-out for waiting data from a client.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: 5s

[Endpoint.<tag>.]StreamMaxLength

{size}

Maximum size of data that can be received from a client (while passing data for scanning as a stream of bytes).

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: 25mb

[Endpoint.<tag>.]ScanTimeout

{time interval}

Time-out for scanning one file or one chunk of data received from a client.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Allowed values: from 1 second (1s) to 1 hour (1h).

Default value: 3m

[Endpoint.<tag>.]HeuristicAnalysis

{On | Off}

Enable heuristic analysis during scanning.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: On

[Endpoint.<tag>.]PackerMaxLevel

{integer}

Maximum nesting level for packed objects. A packed object is executable code compressed with special software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects and so on. The maximum nesting level is the limit beyond which packed objects inside other packed objects are not scanned.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

[Endpoint.<tag>.]ArchiveMaxLevel

{integer}

Maximum nesting level for archives (.zip, .rar and so on). Archives may include archives in which other archives may also be enclosed and so on. The maximum nesting level is the limit beyond which archives inside archives are not scanned.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

[Endpoint.<tag>.]MailMaxLevel

{integer}

Maximum nesting level for files of mailers (.pst, .tbb and so on) in which other files may be enclosed, whereas these files may also include other files and so on. The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

[Endpoint.<tag>.]ContainerMaxLevel

{integer}

Maximum nesting level for other types of objects containing other objects (for instance, HTML pages or .jar files). These objects may include other objects, which in turn may also include others and so on. The maximum nesting level is the limit beyond which objects inside objects are not scanned.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

[Endpoint.<tag>.]MaxCompressionRatio

{integer}

Maximum allowed compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio of an object exceeds the limit, this object is skipped during the scanning.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

The compression ratio must be no less than 2.

Default value: 500

[Endpoint.<tag>.]ReportPasswordProtected

{integer}

Report an error, if the scanned files are protected with a password.

If the Endpoint.<tag> prefix is specified, the parameter value is specified only for the <tag> point; otherwise, it is specified for all points that do not have a defined value of this parameter.

Default value: No