{"id":188,"date":"2011-09-20T05:55:00","date_gmt":"2011-09-20T05:55:00","guid":{"rendered":"http:\/\/pheonixsolutions.com\/?p=188"},"modified":"2026-04-29T18:34:14","modified_gmt":"2026-04-29T13:04:14","slug":"script-for-scanning-the-server-by-using-clamscan-cron","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/script-for-scanning-the-server-by-using-clamscan-cron\/","title":{"rendered":"Automated ClamAV Virus Scan Script with Cron (cPanel Server)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>Introduction<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This script uses <strong>ClamAV (<code>clamscan<\/code>)<\/strong> to scan all cPanel user directories for malware and sends an email alert if infections are found. It can be scheduled via cron for regular automated scanning.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Prerequisites<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before using this script, ensure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ClamAV is installed (<code>clamscan<\/code>, <code>freshclam<\/code>)<\/li>\n\n\n\n<li>Mail service is configured on the server<\/li>\n\n\n\n<li>Directory <code>\/root\/clamreport\/<\/code> exists<\/li>\n\n\n\n<li>Root or sudo access<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Script<\/strong><\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/bin\/bash# Email to receive alertsEMAIL=\"your-email@example.com\"# Temporary fileTMP_FILE=\"\/tmp\/clamscan_report.txt\"# Report directoryREPORT_DIR=\"\/root\/clamreport\"mkdir -p $REPORT_DIR# Flag to check infectionsINFECTED=0# Update virus definitions\/usr\/local\/clamav\/bin\/freshclam >\/dev\/null 2>&amp;1# Loop through all cPanel usersfor user in $(cut -d: -f2 \/etc\/trueuserdomains | xargs); do    SCAN_PATH=\"\/home\/$user\/public_html\"    if [ -d \"$SCAN_PATH\" ]; then        \/usr\/local\/clamav\/bin\/clamscan -ir \"$SCAN_PATH\" > \"$TMP_FILE\"        if grep -q \"FOUND\" \"$TMP_FILE\"; then            grep \"FOUND\" \"$TMP_FILE\" > \"$REPORT_DIR\/$user.report\"            INFECTED=1        fi    fidone# Send alert if infection foundif [ $INFECTED -eq 1 ]; then    SUBJECT=\"CLAMAV ALERT on $(hostname)\"    MESSAGE=\"Malware detected on server $(hostname). Check reports in $REPORT_DIR.\"    echo \"$MESSAGE\" | mail -s \"$SUBJECT\" \"$EMAIL\"fi# Cleanuprm -f \"$TMP_FILE\"<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Schedule via Cron<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Daily Scan<\/strong><\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">crontab -e<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">0 2 * * * \/root\/clamscan.sh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Runs daily at <strong>2:00 AM<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Weekly Scan<\/strong><\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">0 3 * * 0 \/root\/clamscan.sh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Runs every <strong>Sunday at 3:00 AM<\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Notes<\/strong><\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scanning large servers may consume high CPU \u2192 schedule during low traffic<\/li>\n\n\n\n<li>Consider using <code>clamdscan<\/code> for better performance (daemon mode)<\/li>\n\n\n\n<li>Ensure email alerts are working (<code>mail<\/code> command configured)<\/li>\n\n\n\n<li>Reports are saved per user in <code>\/root\/clamreport\/<\/code><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This automated ClamAV script helps detect malware across all cPanel user accounts and ensures timely alerts. Scheduling it via cron improves server security with minimal manual effort.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction This script uses ClamAV (clamscan) to scan all cPanel user directories for malware and sends an email alert if [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1020],"tags":[],"class_list":["post-188","post","type-post","status-publish","format-standard","hentry","category-containers-kubernetes","psol-cat-containers-kubernetes"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-32","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=188"}],"version-history":[{"count":2,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/188\/revisions"}],"predecessor-version":[{"id":10067,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/188\/revisions\/10067"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}