Linux configuration

Optional endpoint settings for Linux agents after install. None of these are required for a basic agent that only reports to the hub. Most Anti-Virus and FIM policy is configured on the hub; see Asset Management. For install and registration, see Installation.

Anti-Virus (clamd) (optional)

ClamAV is disabled by default. Enable malware detection only if you want on-disk / realtime scanning: use Asset Management → Agent Management → AV Settings, then Save. That configures and starts clamd on the agent (for example clamd@scan on RHEL/Rocky 9).

If you also plan to use memscan, do not enable memscan until clamd is running.

Memory Based Scanning (memscan) (optional)

memscan is optional and not enabled by default. It polls running processes and submits previously unseen executable content to clamd. Supported on RHEL 8/9 and Rocky 8/9 (x86_64) via the systemd unit memscan.

Enable only after clamd is running:

systemctl enable --now memscan
systemctl status memscan

FOUND detections are written to the system journal/syslog and decoded on the hub as rule 52526. See Memory Based Scanning under Asset Management.