[clamav] Add plugin for ClamAV by suraj-cmd · Pull Request #4429 · sosreport/sos

suraj-cmd · 2026-08-09T16:40:48Z

ClamAV is packaged for Fedora, RHEL via EPEL, Debian and Ubuntu, but sos has no
plugin for it and no other plugin references it. Neither the daemon
configuration, the freshclam update state nor the signature database age
reaches an sosreport.

The configuration layout differs by distribution: Red Hat splits the daemon
configuration into /etc/clamd.d/ while Debian keeps everything under
/etc/clamav/, so both are collected. Defaults are taken from the upstream
samples in etc/, which set DatabaseDirectory to /var/lib/clamav and
UpdateLogFile to /var/log/freshclam.log.

clamconf is ClamAV's own configuration dump utility and is run in preference
to parsing the files directly.

The signature database is not copied. It is hundreds of megabytes of binary
.cvd data; a directory listing still shows which definitions are present and
how old they are.

etc/freshclam.conf.sample documents HTTPProxyUsername and
HTTPProxyPassword for outbound proxy access, so postproc() redacts both.
HTTPProxyServer is left intact.

Example of the substitution:

HTTPProxyPassword mypass    ->    HTTPProxyPassword ********

Paths and defaults are taken from the upstream configuration samples rather
than a running system. The postproc() regex was tested against sample lines.
Unit names vary between distributions — I have covered clamav-daemon,
clamav-freshclam, clamd@scan and freshclam; confirmation of the packaged
names would be welcome.

Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines

Is the commit message split over multiple lines and hard-wrapped at 72 characters?
Is the subject and message clear and concise?
Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
Does the commit contain a Signed-off-by: First Lastname email@example.com?
Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?
Are all passwords or private data gathered by this PR obfuscated?

packit-as-a-service · 2026-08-09T16:43:56Z

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

sudo dnf install -y 'dnf*-command(copr)'
dnf copr enable packit/sosreport-sos-4429
And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

packit-as-a-service · 2026-08-09T16:43:56Z

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

sudo dnf install -y 'dnf*-command(copr)'
dnf copr enable packit/sosreport-sos-4429
And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

TurboTurtle

Minor notes. I'm going to pause on reviewing the other many new plugin PRs for the moment, as several of them seem to follow the same pattern of specifying units for journal and service status collection without defining the services tuple.

I also need to ask, were these PRs AI-assisted? It's fine if they were, but this project requests that that fact be part of the commit message with an Assisted-By line, as noted in our AI Policy

TurboTurtle · 2026-08-09T23:08:24Z

+        self.add_service_status([
+            'clamav-daemon',
+            'clamav-freshclam',
+            'clamd@scan',
+            'freshclam',
+        ])
+
+        self.add_journal(units=[
+            'clamav-daemon',
+            'clamav-freshclam',
+            'clamd@*',
+            'freshclam',
+        ])


If you add these items to the services tuple as part of the class definition, the journals and service statuses are collected automatically, and serve as an additional enable trigger.

Thanks for the review, and for pausing rather than working through them one at
a time — that was the right call, there were too many at once.

For context on where they came from: I've spent about eight years in enterprise
support — Red Hat , then AWS, now Cloudera — working escalations across
RHEL, clustering and cloud infrastructure. The plugins came out of services I
have repeatedly had no data for when working case

Ok, but that doesn't answer the question. The replies throughout these PRs are obviously AI generated, as are the commit messages. The sheer volume of changes coming in also supports this.

We do not mind accepting AI-assisted changes, but it needs to be noted as described in policy. Additionally, we expect non-code interactions, such as discussions, to be with humans.

Hi @TurboTurtle ,

Thanks for calling this out. I want to clarify that the PRs and the discussions/comments from my side are written by me. I have been working on these changes myself and interacting on the PRs directly.

I do use AI tools occasionally as an assistance tool for things like wording or reviewing, but the technical investigation, changes, testing, and decisions behind the PRs are mine. I also understand and respect the project policy around disclosing AI assistance, and I’ll make sure to follow that going forward where applicable.

Regarding the concern about non-code interactions, I’m happy to continue the discussions directly and address any technical questions myself.

I appreciate you raising this and I’m happy to clarify anything further.

TurboTurtle · 2026-08-09T23:09:09Z

+
+        # The signature database is large and binary; a listing is enough
+        # to show which definitions are present and how old they are.
+        self.add_dir_listing('/var/lib/clamav', tags='clamav_database')


The DB location is configurable. Is it worth sourcing the directory from the config file?

Yes, agreed. DatabaseDirectory in freshclam.conf defaults to /var/lib/clamav
but gets moved often enough that a hardcoded path would miss it exactly when
someone is debugging stale signatures.

ClamAV is packaged for Fedora, RHEL via EPEL, Debian and Ubuntu, but sos has no plugin for it and no other plugin references it. Neither the daemon configuration, the freshclam update state nor the signature database age reaches an sosreport. The configuration layout differs by distribution: Red Hat splits the daemon configuration into /etc/clamd.d/ while Debian keeps everything under /etc/clamav/, so both are collected. Defaults are taken from the upstream samples in etc/, which set DatabaseDirectory to /var/lib/clamav and UpdateLogFile to /var/log/freshclam.log. clamconf is ClamAV's own configuration dump utility and is run in preference to parsing the files directly. The signature database is not copied. It is hundreds of megabytes of binary .cvd data; a directory listing still shows which definitions are present and how old they are. etc/freshclam.conf.sample documents HTTPProxyUsername and HTTPProxyPassword for outbound proxy access, so postproc() redacts both. HTTPProxyServer is left intact. Example of the substitution: HTTPProxyPassword mypass -> HTTPProxyPassword ******** Signed-off-by: Suraj Patil <surajpatil522@gmail.com>

cron.py covers cron, but nothing in the tree references atd, /etc/at.allow, /etc/at.deny, /var/spool/at or atq. An sosreport from a host using at contains no record of the daemon, its access control files or its pending queue. The plugin collects the allow and deny lists, the distribution defaults files, atq output, and the service status and journal for atd. Queued jobs under /var/spool/at are not copied. Each is a complete shell script that embeds the submitting user's environment, which frequently includes exported credentials. A recursive directory listing is taken instead, which still shows the pending jobs, their queue, ownership and submission time. The units are declared in the services tuple rather than explicit add_service_status() and add_journal() calls, per review on sosreport#4429. Signed-off-by: Suraj Patil <surajpatil522@gmail.com>

TurboTurtle

Code looks ok now.

Please add an Assisted-by line to the commit message when using an AI assistant as per our AI policy.

TurboTurtle reviewed Aug 9, 2026

View reviewed changes

TurboTurtle added Status/Needs Review This issue still needs a review from project members Kind/New plugin New plugin being added labels Aug 9, 2026

suraj-cmd force-pushed the add-clamav-plugin branch from 42c9ddf to 62e2863 Compare August 10, 2026 12:01

suraj-cmd mentioned this pull request Aug 13, 2026

[atd] Add plugin for the at job scheduler #4421

Open

6 tasks

TurboTurtle reviewed Aug 13, 2026

View reviewed changes

pmoravec approved these changes Aug 14, 2026

View reviewed changes

Navigation Menu

Uh oh!

[clamav] Add plugin for ClamAV - #4429

[clamav] Add plugin for ClamAV#4429
suraj-cmd wants to merge 1 commit into
sosreport:mainfrom
suraj-cmd:add-clamav-plugin

suraj-cmd commented Aug 9, 2026

Uh oh!

packit-as-a-service Bot commented Aug 9, 2026

Uh oh!

packit-as-a-service Bot commented Aug 9, 2026

Uh oh!

TurboTurtle left a comment

Uh oh!

TurboTurtle Aug 9, 2026

Uh oh!

suraj-cmd Aug 10, 2026

Uh oh!

TurboTurtle Aug 10, 2026

Uh oh!

suraj-cmd Aug 10, 2026 •

edited

Loading

Uh oh!

TurboTurtle Aug 9, 2026

Uh oh!

suraj-cmd Aug 10, 2026

Uh oh!

TurboTurtle left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

suraj-cmd commented Aug 9, 2026

Uh oh!

packit-as-a-service Bot commented Aug 9, 2026

Uh oh!

packit-as-a-service Bot commented Aug 9, 2026

Uh oh!

TurboTurtle left a comment

Choose a reason for hiding this comment

Uh oh!

TurboTurtle Aug 9, 2026

Choose a reason for hiding this comment

Uh oh!

suraj-cmd Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

TurboTurtle Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

suraj-cmd Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TurboTurtle Aug 9, 2026

Choose a reason for hiding this comment

Uh oh!

suraj-cmd Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

TurboTurtle left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

suraj-cmd Aug 10, 2026 •

edited

Loading