Package: clamnotif
ClamNotif: Monitor ClamAV Health Reports AutomaticallyClamNotif, a.k.aClamAV Notification, is a handy and simple tool written in Python, which is able to forward notifications to different recipients categorised by two severity levels of the regular health reports produced byclamscanbundled with theClamAVantivirus engine.What challenge we had facedWe,PiSoft Company Ltd., is a software company based inMacao S.A.R. For more than a decade, we have been developing , operating and maintaining software systems for many clients. For system security, we use ClamAV to scan the server regularly.Usually, that is done in the form of a daily heath check on the server. Because ClamAV is an antivirus engineonly, in order to make our operation as automatic as possible, we have to find a solution to forward those health reports automatically.As part of our daily operations, if ClamAV doesn't find any thing infected, a health report should be forwarded to our maintenance team as aheart-beatingsignal. This is quite important, especially during thepilot period, which is the very beginning of a new system running in Production.On the other hand, if ClamAV finds some files infected, the health report shall be forwarded to our maintenance team as well as therepresentativeof our client as analert.We googled for a solution with no luck, only some pieces of bash scripts cooperating withmailxavailable. Perhaps, building a tool ourselves for our requirement seemsunavoidable.InstallationFirst of all, we can install ClamNotif by$pip3installclamnotiflet's check if it works properly$python3-mclamnotifWe should see$python3-mclamnotifWelcome for using ClamNotif v0.0.5 from PiSoft Company Ltd.Usage: python3 -m clamnotif [--test-smtp|--check-report]ConfigurationPrepare Our ConfigurationsThe configuration file of ClamNotif is aninifile designed with intuitive variable names. Please make sure to save the configuration file as~/.clamnotif/clamnotif.cfg.ClamNotifalwaysreads all configurations under the home folder of the current user. Thus theread permissionof the configuration file needs to be granted to ClamNotif, which should be the default in most cases.Once our configuration completes, please make sure theClamAVReportFolderas well as the files inside the folder can be read by the current user. In the following case, we have to check the directory~/.ClamAV/daily/.When the system is getting more and more stable, a daily notification would not be necessary. We can fine-tune how often a heart-beat is sent by settingHeartbeatDayGap. In the following example, suppose ClamNotif forwarded a heart-beat on 17/Apr, the next heart-beat would be sent on 19/Apr, i.e.,2 dayslater. This value has no impact on the sending of alerts. Once an alert is detected, it will be sent to the recipients immediately.[SMTP]SMTPServerHost=smtp.gmail.comSMTPServerPort=465SMTPTLSEnabled=false[Notification]SenderAddress=foo@gmail.comSenderPasswd=$@SendPwdAlertSubject=My System Antivirus Notification - Alert !!!AlertReceiverAddresses=alice@gmail.com,robert@gmail.com,sysadmin@gmail.comHeartbeatSubject=My System Antivirus Heartbeating NotificationHeartbeatReceiverAddresses=sysadmin@gmail.comHeartbeatDayGap=2[ClamAV]ClamAVReportFolder=~/.ClamAV/daily/Test Our ConfigurationsLet's send a testing email to all recipients defined in the configuration file above by turning on the flag--test-smtp. Check our email box to see if we can receive the email for testing.$python3-mclamnotif--test-smtpSuccessfully sent a testing email with title 'ClamNotif Testing' to foo@gmail.com and alice@gmail.com,robert@gmail.com,sysadmin@gmail.com.If it works, we can go further. The flag--check-reporttells ClamNotif to check theClamAVReportFolderand to send a notification to the appropriate recipients.$python3-mclamnotif--check-report[Should add the command outputs later]python3 -m clamnotif --check-reportis the most common usage of ClamNotif.Run ClamNotif DailyWe are able to runclamnotifregularly by registering it as a schedule job withcrontab.Here is an articleComplete Beginners Tutorialfor your reference.Bash ScriptsThere are some handybashscripts which we use to wrapclamscanandclamnotifunder thebashfolder. Just see if they are helpful.AcknowledgementWe built this tool in memory ofMr Brain Iu, who was a visionary in the field of software development and had been promoting the Python Programming Language in Macao long before it became all the rage .Hope you find it useful. Drop me a line if you like it!