Use clamscan for a one-time scan when a Linux server cannot spare memory for a permanently running malware-scanning daemon. It creates the ClamAV engine, loads signatures for that run, scans the path you specify, writes its results, and exits. Start with a narrow target, cap archive and recursion work, log everything, and quarantine detections instead of deleting them.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
ClamAV’s current guidance recommends at least 3 GiB of RAM for Linux server editions, with 3–4 GiB a sensible target for constrained servers or containers, plus about 5 GiB of free disk space for the application. A smaller host may work, but limits, scheduling, and monitoring become more important.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What an on-demand ClamAV scan does
clamscan is ClamAV’s one-time command-line scanner. It does not require a running clamd instance: each invocation creates an engine, loads the installed signature database, scans the requested file or directory, reports what it found, and exits. That makes it useful on a low-memory server where keeping a daemon and its engine resident would leave less memory for the services that matter.
The trade-off is startup cost. Signatures must be loaded for every run, so repeated scans are less efficient than sending files to a continuously running daemon. On a constrained host, however, releasing the scanner after each job can be preferable to reserving memory continuously.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| Approach | Memory residency | Coverage choice | Best fit |
|---|---|---|---|
clamscan |
Engine and signatures are loaded for one run, then released | One file, one directory, a recursive tree, or a curated file list | Manual checks, scheduled batches, and hosts where permanent daemon memory is undesirable |
Daemonized scanning through clamd |
Scanner service remains running between requests | Requests are sent to the already-running service | High-throughput workflows that can reserve memory for a resident service |
There is no separate “quick scan” mode. ClamAV describes itself as a malware-detection toolkit rather than an endpoint-security suite, so speed comes from choosing a sensible scope and setting limits—not from a hidden fast profile.
Check memory, disk, and signatures first
Confirm the host can start the scanner
ClamAV’s current documentation recommends 3 GiB or more of RAM for FreeBSD and Linux server editions. For constrained servers and Docker environments, it suggests aiming for 3–4 GiB when possible. The documentation also recommends 5 GiB of free disk space for the ClamAV application. These are recommendations, not a guarantee that a smaller machine will fail, but they are important when deciding whether to scan locally or move the job elsewhere.
- Check available RAM, not only the amount installed. Other services, filesystem cache, and existing swap activity affect whether the scan can complete.
- Check free space on the filesystem holding the application, signature database, logs, and any quarantine directory.
- Identify a writable log location and, if you will quarantine files, a writable quarantine directory with enough room for the files being moved or copied.
- Plan the scan for a low-load period. Monitor memory, swap, storage I/O, and the health of the server’s normal services while it runs.
Make sure the signature database is installed and current
Install ClamAV and its signature database through the operating system’s supported update mechanism. Run the supported signature-update process before scanning, and verify that it completed successfully. Do not describe a scan as current merely because clamscan launched; the result depends on the database that was actually installed when the scan began.
Keep the update and scan as separate operational steps. If an update fails, record that failure and treat the subsequent scan as a scan with an unconfirmed signature age rather than silently presenting it as up to date.
Choose the smallest useful scan scope
Scan one file
clamscan /srv/uploads/file.isoThis is the least expensive starting point when you have a known upload, attachment, archive, or other specific item to check.
Scan a directory without descending into children
clamscan /srv/uploadsA plain directory path scans the files in that directory. It does not turn the request into a recursive scan of every child directory.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesScan a directory recursively and write a report
clamscan --recursive --log=/var/log/clamav/uploads-scan.log /srv/uploads--recursive includes subdirectories. The log gives you an audit trail that remains available after the process exits, which is especially useful for scheduled jobs and incident review.
Consider a full-filesystem scan carefully
A recursive scan of an entire filesystem examines far more files and can consume substantial CPU, I/O, memory, and time. It should be scheduled for a maintenance window, with explicit exclusions for paths that do not represent ordinary files. On a small server, start with the directories that contain uploads, web content, user data, backups, or other realistic malware entry points. Expand the scope only when the additional coverage justifies the load.
Bound work before scanning a low-memory host
Archive expansion and deep directory trees can make a seemingly small path expensive. The following example applies several independent limits:
clamscan --recursive
--log=/var/log/clamav/uploads-scan.log
--exclude-dir='^/srv/uploads/cache(/|$)'
--max-filesize=50M
--max-scansize=200M
--max-files=2000
--max-recursion=8
--max-dir-recursion=12
/srv/uploadsThis is an example policy, not a universal safe profile. Tune each value to the host, workload, and acceptable false-negative risk. A file larger than --max-filesize, archive content beyond --max-scansize, or content deeper than a recursion limit may be skipped or reported as exceeding a limit rather than fully inspected. A bounded scan is therefore not equivalent to an unrestricted scan.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
What each limit controls
| Option | Purpose | Operational consequence |
|---|---|---|
--max-filesize |
Limits the size of an individual file considered for scanning | Very large files may not be fully inspected |
--max-scansize |
Limits the amount of data ClamAV scans, including expanded archive content | Large compressed or containerized content can be cut off |
--max-files |
Limits the number of files processed | A directory containing more files than the cap will not be covered completely |
--max-recursion |
Limits nested archive or content recursion | Deeply nested content may remain uninspected |
--max-dir-recursion |
Limits directory-tree depth | Deep child directories may be omitted |
--max-scantime |
Places a time limit on scanning work | Items that exceed the limit may not receive a complete inspection |
Use limits to protect availability, not to claim complete coverage. If your threat model includes oversized files or deeply nested archives, run a separate, better-resourced scan rather than assuming the bounded result is definitive.
Know the current defaults, then verify the host’s build
The current Cisco-Talos manual lists the following defaults. Defaults can vary by ClamAV release and Linux distribution, so check the installed binary with clamscan --help before relying on a value in an automation policy.
| Setting | Manual default | Value in practical terms |
|---|---|---|
--max-scantime |
120000 ms | 120 seconds |
--max-filesize |
100 MB | Per-file size ceiling |
--max-scansize |
400 MB | Scan-data ceiling, including expanded content |
--max-files |
10000 | Maximum files processed |
--max-recursion |
17 | Maximum nested-content depth |
--max-dir-recursion |
15 | Maximum directory depth |
Do not copy these numbers into a production policy without checking the local help output. A distribution may carry a different release or configuration, and a policy that depends on an exact default should set the option explicitly.
Use exclusions and file lists deliberately
Exclude known caches or generated trees
--exclude and --exclude-dir accept regular expressions and can be repeated. The bounded example excludes a cache directory with an anchored expression:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute--exclude-dir='^/srv/uploads/cache(/|$)'Exclude only data you understand. Caches, generated artifacts, mounted pseudo-filesystems, and temporary trees can contain suspicious content or the only copy of a file you need to investigate. Every exclusion reduces coverage.
Scan a curated list
For a controlled set of files, create a newline-delimited list and pass it to:
clamscan --file-list=/path/to/listA file list can reduce traversal overhead and makes the intended scope reviewable. Keep the list with the log when you need to demonstrate exactly what was checked.
Log results and handle detections safely
Reduce console noise without losing the audit trail
Use --infected to show only infected files, or --suppress-ok-results to hide clean-file messages. Pair either choice with --log=FILE so the full operational result is preserved for review.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →clamscan --recursive
--infected
--log=/var/log/clamav/uploads-scan.log
/srv/uploadsQuarantine by moving or copying
Prefer a controlled quarantine directory rather than automatic deletion:
clamscan --recursive
--move=/var/quarantine
--log=/var/log/clamav/uploads-scan.log
/srv/uploadsTo retain the original while creating a quarantine copy, use:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
clamscan --recursive
--copy=/var/quarantine
--log=/var/log/clamav/uploads-scan.log
/srv/uploadsThe quarantine directory must be writable by the account running the scan. Restrict access to it, preserve the log, and define how an administrator will review and release a false positive.
Why automatic deletion is risky
The official documentation warns that --remove can delete false positives. Malware signatures and detection decisions require review in the context of the file and service that uses it. Do not automate deletion unless you have a tested review and recovery process; moving or copying gives you evidence and a path back if the detection is wrong.
Do not disable bytecode to save memory
The Cisco-Talos manual highly recommends keeping bytecode enabled because disabling it may miss detections for many new viruses. On a low-memory host, reduce workload with narrower paths, exclusions, archive limits, and scheduling before considering a detection feature that affects coverage. A scan that uses less memory but disables an important detection capability may create a larger security gap than the resource problem it was meant to solve.
Monitor a scan while it runs
There is no universal runtime figure for a low-memory server. Duration depends on file count, storage speed, archive contents, exclusions, and every limit you set. A whole-filesystem scan can take a long time, and ClamAV does not provide a special quick-scan mode.
- Watch available memory and swap. Rising swap use indicates that the scan is competing with other services for RAM.
- Watch disk latency and throughput. A scan can make an otherwise healthy application appear slow when storage is saturated.
- Check the health of the services sharing the host. Stop or defer the scan if its load threatens production availability.
- Review the log after completion for skipped, exceeded, or otherwise incomplete items. A clean result is meaningful only within the scope and limits you selected.
For an especially fragile host, test the bounded command against a small representative directory first. Increase the target or limits in stages, observing the same resource signals each time.
A repeatable low-memory workflow
- Inspect capacity. Confirm available RAM, swap behavior, and at least the recommended free disk space for the application, logs, signatures, and quarantine.
- Update signatures. Use the operating system’s supported update mechanism and verify that it completed successfully.
- Define the target. Start with a single file, a single directory, or a curated
--file-listrather than the whole filesystem. - Define exclusions. Exclude only caches, generated data, or pseudo-filesystems whose coverage trade-off you have accepted.
- Set explicit limits. Choose file-size, scan-size, file-count, archive-recursion, directory-recursion, and, where appropriate, scan-time caps.
- Choose an evidence policy. Write a log, use
--infectedor--suppress-ok-resultsfor readable output, and send detections to a protected quarantine. - Run during low load. Monitor memory, swap, I/O, and application health while the process is active.
- Review limitations. Investigate any files or content skipped because of a limit before treating the scan as sufficient.
- Escalate when necessary. If the host cannot meet the documented memory guidance or the required coverage is too expensive, perform the unrestricted or broader scan on a better-resourced system instead of weakening detection features.
Command reference
| Need | Command or option |
|---|---|
| One file | clamscan FILE |
| One directory, no recursive option | clamscan DIRECTORY |
| Recursive directory scan | clamscan --recursive DIRECTORY |
| Write a report | --log=FILE |
| Scan a newline-delimited list | --file-list=FILE |
| Exclude matching paths | --exclude=REGEX |
| Exclude matching directories | --exclude-dir=REGEX |
| Cap file size | --max-filesize |
| Cap total scan data | --max-scansize |
| Cap file count | --max-files |
| Cap nested content | --max-recursion |
| Cap directory depth | --max-dir-recursion |
| Cap scan time | --max-scantime |
| Move detections | --move=DIRECTORY |
| Copy detections | --copy=DIRECTORY |
| Show scanner memory information | clamscan --memory (administrator access required) |
When a scan appears to fail or provide an incomplete answer
The process is terminated under memory pressure
Reduce the target first, then lower archive, file-count, and recursion limits. Run during a quieter period and check whether another service or swap activity is consuming the available memory. If the required coverage still cannot fit, use a better-resourced scanning host rather than disabling bytecode.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The scan is too slow
Confirm that you did not unintentionally request a recursive or whole-filesystem scan. Exclude understood caches and generated trees, use a curated file list, and cap archive expansion. Storage performance and archive contents can dominate runtime even when the directory itself looks small.
Large or nested content is not fully inspected
Check the configured limits and the log for exceeded values. Raise a limit only when the host can absorb the additional work and the extra coverage is worth the resource cost. A result from content beyond a cap must be treated as partial.
A detection may be a false positive
Do not use --remove as a first response. Preserve the log and the original through --move or --copy, then have an administrator review the quarantined item and restore it through a controlled process if it is legitimate.
The result is described as current, but updating failed
Separate the update record from the scan record. If the signature update did not complete successfully, report the scan with that qualification and retry the update through the supported mechanism before relying on a new result.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
