<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <!--Converted with LaTeX2HTML 2K.1beta (1.48) original version by: Nikos Drakos, CBLU, University of Leeds * revised and updated by: Marcus Hennecke, Ross Moore, Herb Swan * with significant contributions from: Jens Lippmann, Marek Rouchal, Martin Wilck and others --> <HTML> <HEAD> <TITLE>Output format</TITLE> <META NAME="description" CONTENT="Output format"> <META NAME="keywords" CONTENT="clamdoc"> <META NAME="resource-type" CONTENT="document"> <META NAME="distribution" CONTENT="global"> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="LaTeX2HTML v2K.1beta"> <META HTTP-EQUIV="Content-Style-Type" CONTENT="text/css"> <LINK REL="STYLESHEET" HREF="clamdoc.css"> <LINK REL="next" HREF="node20.html"> <LINK REL="previous" HREF="node18.html"> <LINK REL="up" HREF="node15.html"> <LINK REL="next" HREF="node20.html"> </HEAD> <BODY > <!--Navigation Panel--> <A NAME="tex2html258" HREF="node20.html"> <IMG WIDTH="37" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="next" SRC="/usr/share/latex2html/icons/next.png"></A> <A NAME="tex2html256" HREF="node15.html"> <IMG WIDTH="26" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="up" SRC="/usr/share/latex2html/icons/up.png"></A> <A NAME="tex2html250" HREF="node18.html"> <IMG WIDTH="63" HEIGHT="24" ALIGN="BOTTOM" BORDER="0" ALT="previous" SRC="/usr/share/latex2html/icons/prev.png"></A> <BR> <B> Next:</B> <A NAME="tex2html259" HREF="node20.html">FreshClam</A> <B> Up:</B> <A NAME="tex2html257" HREF="node15.html">Usage</A> <B> Previous:</B> <A NAME="tex2html251" HREF="node18.html">Archives and compressed files</A> <BR> <BR> <!--End of Navigation Panel--> <H2><A NAME="SECTION00034000000000000000"> Output format</A> </H2> <I>clamd</I> uses uniformed output format. <PRE> zolw@Wierszokleta:~$ telnet localhost 3310 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. SCAN /home/zolw/infected /home/zolw/infected/sobre.com: W32/Magistr.B FOUND Connection closed by foreign host. </PRE> It always closes the connection when first virus is found. In the case of archives, the output is exactly the same like with normal files: <PRE> SCAN /home/zolw/Clam/test/test2.zip /home/zolw/Clam/test/test2.zip: ClamAV-Test-Signature FOUND </PRE> Error messages are printed in the following format: <PRE> SCAN /no/such/file /no/such/file: Can't stat() the file ERROR </PRE> and they can be easily parsed. <P> <I>clamscan</I> writes all messages (only help is written to <B>stdout</B> by default) to <B>stderr</B>. In some situations you may want to redirect it to <B>stdout</B> with <I>-stdout</I>. <I>stdout</I> in contrast to <I>stderr</I> is buffered, that's why <I>clamscan</I> flushes this buffer after each message, to prevent the creation of trashes on the output. During scanning it writes something like this: <PRE> /TEST/test: OK /TEST/Makefile: OK /TEST/getopt.c: OK /TEST/virfile: Phantom #1 FOUND </PRE> When a virus is found, its name is printed between <I>filename:</I> and <I>FOUND</I>. <P> As you can see, zip files inside the zip file were scanned. If a virus is found in the (compressed) archive, it's noticed with <I>Infected Archive</I>. Infected archives are not counted as infected files - just files in them are. After scanning you should see <I>Scan summary</I> (it may be disabled with <I>-disable-summary</I>. It looks like: <P> <BR><HR> <ADDRESS> Tomasz Kojm 2002-11-21 </ADDRESS> </BODY> </HTML>