This topic contains sample logs emitted by Anti-Virus for VMware Tanzu. You can use these samples to configure a Security Information and Event Management (SIEM) system to verify regular activity and generate alerts for virus detections or outdated virus signatures.
Anti-Virus for Tanzu Logs
There are four distinct Anti-Virus for VMware Tanzu apps that run on each VM:
- freshclam
- go-clam-tls
- clamd
- clamdscan
The freshclam and go-clam-tls apps are mutually exclusive, but the other apps work together to detect viruses and protect the VM. If On-Access scanning is enabled for Linux, then an additional app is run: clamonacc.
Each app writes its own log file. You need to monitor each of these files to know if Anti-Virus for Tanzu is working correctly and if viruses have been found.
VMware recommends that you enable syslog forwarding so that the messages from each of the log files is aggregated into the syslog file on the remote syslog server. Then you can use your preferred monitoring and alerting tool to review the Anti-Virus for Tanzu log entries.
For an example of how Anti-Virus for Tanzu messages appear in the syslog file, see Syslog Format.
For information about each app, see freshclam, go-clam-tls, clamd, and clamdscan below.
freshclam App
The freshclam app updates the database that stores the known virus signatures.
The messages output by the freshclam app indicate when freshclam checks for updates, what the download progress is, and the downloaded signature version.
The log file for the freshclam app is /var/vcap/sys/log/antivirus/freshclam.log.
go-clam-tls App
The go-clam-tls app performs the same role as the freshclam app for environments that use Anti-Virus Mirror for VMware Tanzu with Anti-Virus for VMware Tanzu. go-clam-tls uses mutual TLS (mTLS) and permits changing the port used for database updates.
The messages output by the go-clam-tls app indicate when go-clam-tls checks for updates, what the download progress is, and the downloaded signature version.
The log file for the go-clam-tls app is /var/vcap/sys/log/antivirus/go-clam-tls.log.
clamd App
The Clam AntiVirus Daemon (clamd) listens for incoming connections on Unix or the TCP socket. clamd works with clamdscan to scan files or directories. The clamd job uses the database of virus signatures that the freshclam job updates.
The messages output by the clamd app show files where viruses are found, the name of the virus signature, and any action taken (such as moving, copying, or deleting).
The log file for the clamd app is /var/vcap/sys/log/antivirus/antivirus.stdout.log.
clamdscan App
The clamdscan app scans files and directories for viruses using the clamd daemon.
The messages output by the clamdscan app show when a clamdscan is initiated and writes a scan summary on completion.
The log file for the clamd app is /var/vcap/sys/log/antivirus/clamdscan.log.
clamonacc App
If On-Access scanning is enabled, the clamonacc app monitors the file system on the VM and alerts if a potentially malicious file is accessed.
The clamonacc output contains the initialization information only. Any warnings of potential threats are logged in /var/vcap/sys/log/antivirus/antivirus.stdout.log.
The log file for the clamonacc app is /var/vcap/sys/log/antivirus/clamonacc.stdout.log.
Log Messages
The following tables lists common messages that you see when ClamAV apps write to log files:
| Message | App | Meanings | Healthy/unhealthy? |
|---|---|---|---|
| Check for updates | freshclam | States that the freshclam app is checking the configured remote mirror for an update to the local virus signature database. | Healthy |
| Update the virus database | freshclam | States that the virus database is being updated. | Healthy |
| Cannot download CLD database files | freshclam | States that freshclam could not download the latest uncompressed databases. These database files include the main.cld, daily.cld, and bytecode.cld files. They are optional for ClamAV to run. |
Healthy |
| Virus database is Up-to-Date | freshclam | States that the virus database is up-to-date. | Healthy |
| Virus database is older than 7 days | freshclam | States that the virus database is stale. Based on configuration, freshclam checks hourly or daily. | Unhealthy |
| Process terminated | freshclam | freshclam should only terminate during a deployment. | Unhealthy (Will be triggered by deployments) |
| Check for updates | go-clam-tls | States that the go-clam-tls app is checking the configured remote mirror for an update to the local virus signature database. | Healthy |
| Update the virus database | go-clam-tls | States that the virus database is being updated. | Healthy |
| Using CLD database files | go-clam-tls | States that go-clam-tls could not find .cvd files and is failing over to .cld files. | Healthy |
| Virus database is up-to-date | go-clam-tls | States that the virus database is up-to-date. | Healthy |
| Virus database is older than 7 days | go-clam-tls | States that the virus database is stale. Based on configuration, go-clam-tls checks hourly or daily. | Unhealthy |
| Failed to parse local database | go-clam-tls | States that go-clam-tls could not parse the local database. This might be because the database was modified in some way. This message is given on initial startup, because the local database files should not be present. | Unhealthy |
| Mirror database is older than local | go-clam-tls | States that the mirror database is older than the local version. You should investigate your mirror deployment. | Unhealthy |
| Start clamd | clamd | States that a clamd daemon is starting. | Healthy |
| Check for updated virus signatures | clamd | clamd checks if freshclam has updated the local virus signature database. | Healthy |
| Virus detected | clamd | Gives the name and location of the virus that was found and the virus signature that it matches. | Unhealthy |
| Virus removed | clamd | Gives the name of the virus file that was found and states that the file was deleted. | Unhealthy |
| Virus moved | clamd | Gives the name of the virus file found and where it was moved to. The virus file is deleted from original location. |
Unhealthy |
| Virus copied | clamd | Gives the name of the virus file found and where it was copied to. The virus file remains at original location. |
Unhealthy |
| Process terminated | clamd | Both clamd and freshclam should always be running. If the process was terminated, meaning the clamd daemon has stopped, then this error appears and can indicate a problem. Neither on-access scanning nor scheduled scanning is possible if the process state is terminated. | Unhealthy (Will be triggered by deployments) |
| Start scheduled scan | clamdscan | States when the scan starts. Use the time stamp on the message to determine this. | Healthy |
| Scan finished | clamdscan | Gives time elapsed for scan and how many infected files were found. | Healthy |
freshclam Log Messages
The freshclam job on each VM is responsible for updating the database that stores the known virus signatures.
The freshclam log entries relate to whether the virus-signature database is up-to-date.
-
ClamAV update process started at Wed Nov 28 15:58:23 2018
-
Downloading main.cvd [100%] main.cvd updated (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr) Downloading daily.cvd [100%] daily.cvd updated (version: 25135, sigs: 2155329, f-level: 63, builder: neo) Downloading bytecode.cvd [100%] bytecode.cvd updated (version: 327, sigs: 91, f-level: 63, builder: neo) Database updated (6721669 signatures) from my-anti-virus-mirror.s3.example.com (IP: 52.216.169.19)
-
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr) daily.cvd is up to date (version: 25135, sigs: 2155329, f-level: 63, builder: neo) bytecode.cvd is up to date (version: 327, sigs: 91, f-level: 63, builder: neo)
-
Cannot download CLD database files
WARNING: getfile: Unknown response from my-anti-virus-mirror.s3.example.com (IP: 52.216.233.127): HTTP/1.1 403 WARNING: Can't download main.cld from my-anti-virus-mirror.s3.example.com WARNING: getfile: Unknown response from my-anti-virus-mirror.s3.example.com (IP: 52.216.233.127): HTTP/1.1 403 WARNING: Can't download daily.cld from my-anti-virus-mirror.s3.example.com WARNING: getfile: Unknown response from my-anti-virus-mirror.s3.example.com (IP: 52.216.233.127): HTTP/1.1 403 WARNING: Can't download bytecode.cld from my-anti-virus-mirror.s3.example.com
-
Virus database is older than 7 days
[LibClamAV] ************************************************** [LibClamAV] *** The virus database is older than 7 days! *** [LibClamAV] *** Please update it as soon as possible. *** [LibClamAV] **************************************************
-
Update process terminated
go-clam-tls Log Messages
The go-clam-tls job on each VM is responsible for updating the database that stores the known virus signatures.
The go-clam-tls log entries relate to whether the virus-signature database is up-to-date.
-
2019/10/03 20:30:20 go-clam-tls update process started
-
2019/10/03 20:40:15 go-clam-tls update process started 2019/10/03 20:40:15 Warning: could not parse local main.cvd header: open /var/vcap/data/antivirus/main.cvd: no such file or directory 2019/10/03 20:40:26 main.cvd updated (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr, build timestamp: 07 Jun 2017 17-38 -0400) 2019/10/03 20:40:26 Warning: could not parse local daily.cvd header: open /var/vcap/data/antivirus/daily.cvd: no such file or directory 2019/10/03 20:40:31 daily.cvd updated (version: 25591, sigs: 1793277, f-level: 63, builder: raynman, build timestamp: 03 Oct 2019 04-30 -0400) 2019/10/03 20:40:31 Warning: could not parse local bytecode.cvd header: open /var/vcap/data/antivirus/bytecode.cvd: no such file or directory 2019/10/03 20:40:31 bytecode.cvd updated (version: 331, sigs: 94, f-level: 63, builder: anvilleg, build timestamp: 19 Sep 2019 12-12 -0400) 2019/10/03 20:40:31 Clamd socket response: RELOADING 2019/10/03 20:40:31 Databases successfully updated
-
2019/10/03 20:42:31 go-clam-tls update process started 2019/10/03 20:42:31 Anti-Virus Mirror antivirus-mirror.service.internal:6501 returned 404 for main.cvd, trying main.cld... 2019/10/03 20:42:31 Warning: could not parse local main.cld header: open /var/vcap/data/antivirus/main.cld: no such file or directory 2019/10/03 20:42:38 main.cld updated (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr, build timestamp: 07 Jun 2017 17-38 -0400) 2019/10/03 20:42:38 Anti-Virus Mirror antivirus-mirror.service.internal:6501 returned 404 for daily.cvd, trying daily.cld... 2019/10/03 20:42:38 Warning: could not parse local daily.cld header: open /var/vcap/data/antivirus/daily.cld: no such file or directory 2019/10/03 20:42:38 daily.cld updated (version: 25591, sigs: 1793277, f-level: 63, builder: raynman, build timestamp: 03 Oct 2019 04-30 -0400) 2019/10/03 20:42:38 Anti-Virus Mirror antivirus-mirror.service.internal:6501 returned 404 for bytecode.cvd, trying bytecode.cld... 2019/10/03 20:42:38 Warning: could not parse local bytecode.cld header: open /var/vcap/data/antivirus/bytecode.cld: no such file or directory 2019/10/03 20:42:38 bytecode.cld updated (version: 331, sigs: 94, f-level: 63, builder: anvilleg, build timestamp: 19 Sep 2019 12-12 -0400) 2019/10/03 20:42:38 Clamd socket response: RELOADING 2019/10/03 20:42:38 Databases successfully updated
-
2019/10/03 20:30:21 main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr, build timestamp: 07 Jun 2017 17-38 -0400) 2019/10/03 20:30:21 daily.cvd is up to date (version: 25591, sigs: 1793277, f-level: 63, builder: raynman, build timestamp: 03 Oct 2019 04-30 -0400) 2019/10/03 20:30:21 bytecode.cvd is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg, build timestamp: 19 Sep 2019 12-12 -0400)
-
Virus database is older than 7 days
2019/10/03 20:51:14 ************************************************** *** The virus database is older than 7 days! *** *** Please update it as soon as possible. *** **************************************************
-
Failed to Parse Local Database
2019/10/03 20:40:15 Warning: could not parse local main.cvd header: open /var/vcap/data/antivirus/main.cvd: no such file or directory
-
Mirror Database is Older Than Local
2019/10/03 20:40:15 Warning: Current daily.cvd is version 25592 and remote version is 25591
clamd Log Messages
The clamd is the antivirus scanner that searches for viruses. The clamd job uses the database of virus signatures that the freshclam job updates.
-
Wed Nov 28 15:58:47 2018 -> +++ Started at Wed Nov 28 15:58:47 2018 Wed Nov 28 15:59:02 2018 -> Self checking every 600 seconds.
-
Check for updated virus signatures
SelfCheck: Database status OK.
SelfCheck: Database modification detected. Forcing reload
No stats for Database check - forcing reload
-
/var/vcap/data/test.txt: Eicar-Test-Signature FOUND
-
/var/vcap/data/test.txt: Removed.
-
/var/vcap/data/test.txt: moved to '/var/vcap/data/antivirus/found/test.txt.001'
-
/var/vcap/data/test.txt: copied to '/var/vcap/data/antivirus/found/test.txt.001'
-
Wed Nov 28 19:25:23 2018 -> Pid file removed. Wed Nov 28 19:25:23 2018 -> --- Stopped at Wed Nov 28 19:25:23 2018 Wed Nov 28 19:25:23 2018 -> Socket file removed.
clamdscan Log Messages
The clamdscan searches files and directories for viruses.
-
This is not provided in ClamAV Add-on for PCF v1.4.38 and earlier.
Starting scheduled scan
-
This is not provided in ClamAV Add-on for PCF v1.4.38 and earlier.
Sample:
----------- SCAN SUMMARY ----------- Infected files: 1 Time: 346.887 sec (5 m 46 s)
clamonacc Log Messages
clamonacc monitors filesytem access, any interaction with a file triggers a scan of the file. The clamonacc output shows the initialization information.
-
This is not provided in Anti-Virus for VMware Tanzu 2.2 and earlier.
Clamd Socket not yet available. Starting clamonacc: {timestamp} Started clamonacc: {timestamp}
Container Log Messages
Examples of ClamAV log entries from Garden containers and Docker containers are as follows:
-
For a Garden container in VMware Tanzu Application Service for VMs (TAS for VMs)
/var/vcap/data/grootfs/store/unprivileged/images/2264d474-3e57-4934-504f-ddbb/diff/home/vcap/app/public/test.html: Eicar-Test-Signature FOUND
-
For a Docker container in Tanzu Kubernetes Grid Integrated Edition (TKGI)
/var/vcap/store/docker/docker/overlay2/53322c6f7c25bb00224bb03cdfc285e141471d746d5c7a8c5a65db56fda56ecb/diff/test.html: Eicar-Test-Signature FOUND
Anti-Virus for Tanzu Log Format
The logs that Anti-Virus for Tanzu itself outputs do not adhere to a specific structure. However, the syslog forwarder component (which is on all VMs) encapsulates Anti-Virus for Tanzu’s log, and prepends the necessary headers so that the resulting logs adhere to the syslog format.
With syslog-forwarder, the syslog format is:
<PRI> \
VERSION \
TIMESTAMP \
HOST \
APP-NAME \
PROC-ID \
MSG-ID \
[instance@47450 \
director="DIRECTOR" \
deployment="DEPLOYMENT" \
group="INSTANCE-GROUP" \
az="AVAILABILITY-ZONE" \
id="ID"] \
MESSAGE \
Where:
<PRI>is<14>.APP-NAMEisfreshclam,clamdscan, orclamd.MESSAGEis the output from an Anti-Virus for Tanzu app. Examples of the output messages are shown in Log Messages above.
For example, the first two lines of the “Scan Finished” message appearing in the syslog file below:
<14> \
1 \
2018-12-07T21:48:02.119539Z \
10.0.0.3 \
clamav \
rs2 \
- \
[instance@12345 \
director="" \
deployment="clamav-trusty-aaaa-80" \
group="clamav" \
az="z1" \
id="abcdef01-8901-42a5-ad58-8b4c1a2de881"] \
----------- SCAN SUMMARY -----------
<14> \
1 \
2018-12-07T21:48:02.11954Z \
10.0.0.3 \
clamav \
rs2 \
- \
[instance@12345 \
director="" \
deployment="clamav-trusty-rlee-80" \
group="clamav" \
az="z1" \
id="abcdef01-8901-42a5-ad58-8b4c1a2de881"] \
Infected files: 0
For more information, see Format in the syslog-release GitHub repository.
