Mailing List Archive

[clamav-users] Syslog formatting issue
I'm currently running ClamAV in a debian docker container. I've enabled LogSyslog in the clamd.conf and freshclam.conf files. For some reason the log output isn't appending the app-name, procid, nor msgid to the front of the logs. Any idea why this is? I need that metadata so my SEIM can decode the logs correctly. I'm rather green, so please pardon my ignorance. Thank you. A sample of my freshclam.log file below -

Mon Aug 19 22:20:36 2019 -> --------------------------------------
Mon Aug 19 22:20:36 2019 -> Current working dir is /var/lib/clamav
Mon Aug 19 22:20:36 2019 -> freshclam daemon 0.100.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Mon Aug 19 22:20:36 2019 -> Max retries == 5
Mon Aug 19 22:20:36 2019 -> ClamAV update process started at Mon Aug 19 22:20:36 2019
Mon Aug 19 22:20:36 2019 -> Using IPv6 aware code
Mon Aug 19 22:20:36 2019 -> Querying current.cvd.clamav.net
Mon Aug 19 22:20:36 2019 -> TTL: 1800
Mon Aug 19 22:20:36 2019 -> Software version from DNS: 0.101.3
Mon Aug 19 22:20:36 2019 -> WARNING: Your ClamAV installation is OUTDATED!
Mon Aug 19 22:20:36 2019 -> WARNING: Local version: 0.100.2 Recommended version: 0.101.3
Mon Aug 19 22:20:36 2019 -> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
Mon Aug 19 22:20:36 2019 -> main.cvd version from DNS: 58
Mon Aug 19 22:20:36 2019 -> main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Mon Aug 19 22:20:36 2019 -> daily.cvd version from DNS: 25546
Mon Aug 19 22:20:36 2019 -> daily.cld is up to date (version: 25546, sigs: 1727460, f-level: 63, builder: raynman)
Mon Aug 19 22:20:36 2019 -> bytecode.cvd version from DNS: 330
Mon Aug 19 22:20:36 2019 -> bytecode.cld is up to date (version: 330, sigs: 94, f-level: 63, builder: neo)
Mon Aug 19 22:20:36 2019 -> --------------------------------------