AMP for Endpoints: ClamAV Virus Definition Options in Linux

Available Languages

Download Options

  • PDF     (286.9 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (290.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (209.6 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:July 19, 2019
Document ID:214655

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    Starting with Linux Connector version 1.11.0, AMP for Endpoints now offers two ClamAV Virus Definition configuration options:

    1. Linux-only
    2. Full ClamAV

    Prior to the Linux-only option becoming available, the Linux Connector scanned files using the full ClamAV virus definition set. This set includes malware signatures for Linux, macOS, Windows and Android. Although this provides comprehensive coverage, it also requires significant runtime resources (i.e., CPU time and memory). Some Linux systems can benefit from configuring AMP to use the smaller Linux-only ClamAV virus definition set.

    The Linux-only virus definition file size is less than 10% of the full set. Using a smaller set reduces computing overhead and makes it possible to run AMP on resource constrained systems. Despite the performance advantages, reduced coverage for non-Linux malware makes this configuration only suitable for some applications. E.g., It would be suitable for servers that only host/store Linux files (such as application servers) but would not be suitable for servers that also host/store non-Linux files (such as FTP, mail and SMB file servers). The system administrator must balance this trade-off to choose the appropriate set of virus definitions.

    IMPORTANT!

    It is highly recommended that all endpoints be upgraded to Connector version 1.11.0 or newer before using the new Linux-only virus definition option. While 1.10.x and older Connector versions will accept the new option, its behavior in some cases will not be intuitive. Refer to the Backwards Compatibility section for details.

    Backwards Compatibility

    There is an important backwards compatibility issue to consider before configuring endpoints to use the new Linux-only virus definition option: 1.10.x and older Connectors will continue to use the full virus definition if the full set had already been downloaded. If configured to use the new Linux-only virus definition option, the Connector will stop updating the full virus definition set and will only update the Linux virus definition set thereafter. This can result in the endpoint using up-to-date Linux virus definitions but out-of-date macOS, Windows, and Android definitions.

    There are two possible resolutions:

    1. Upgrade the Connector to 1.11.0 or later.
    2. Change the ClamAV Virus Definition setting back to Full ClamAV.

    Changing the ClamAV Virus Definitions Option

    The ClamAV Virus Definition option can be configured using the AMP for Endpoints web portal. The option for each policy can be changed by navigating to:

    Management > Policies > [Linux Policy] > Edit > Advanced Settings > ClamAV

    After the AV Definitions policy setting is changed, the new setting takes effect on the endpoints at the next scheduled virus definition update. That delay is governed by the `Content Update Internal` policy setting.

    The "Some Connectors must be updated to support this virus definition" warning may appear in the ClamAV Advanced Settings screen if at least one Connector managed by the policy is running an incompatible Linux Connector version. It is highly recommended to upgrade the Connectors and resolve this warning before using the Linux-only definitions setting.

    Verifying the New Setting at the Endpoint

    When configured to use Linux-only definitions, the combined resident memory size of the two AMP Connector processes should be below 100 MB.


    This can be examined using the following command:

    top -p `pidof ampdaemon` -p `pidof ampscansvc`

    The following is a sample output: 

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products