Memory Based Scanning (memscan)

memscan polls running processes and submits previously unseen executable content to clamd. Detections are written to the system log and decoded on the hub as rule 52526. Platform enablement (systemd / SMF) is covered under Linux configuration and Solaris configuration. Hub context is under Asset Management.

This page documents memscan options: scanning, logging, and optional malware response actions (log, pause/stop, kill, quarantine). Confirm the installed binary with memscan -V and memscan -h.

Defaults and safety

Package and service defaults keep memscan in detect-only mode:

  • ``action=log`` — log FOUND results; do not stop, kill, or quarantine.

  • Stop / pause, kill, and quarantine are explicit operator opt-ins. Enabling clamd or memscan does not turn them on.

  • Quarantine means kill first, then preserve executable evidence. There is no separate pause-plus-quarantine mode.

  • Unsafe source-path deletion after quarantine (-U / unsafe_quarantine_source_removal) defaults off and remains a separate opt-in even when quarantine is enabled.

Always-protected targets (still scanned and logged; never acted on): PID 1, memscan itself, memscan’s parent, and a process whose executable basename is exactly clamd.

Response actions

Select with -a ACTION or action= in a configuration file.

Action

Behavior

log (default)

Log detections only. No signal, no quarantine.

stop (pause)

Send SIGSTOP (advisory containment). Another process with the same UID can send SIGCONT. If the process resumes, memscan stops it again and may recommend kill. Prefer kill for durable containment.

kill

Send SIGKILL. Recommended containment action when logging alone is not enough.

quarantine

Pin the scanned executable, kill the process (SIGKILL), then copy evidence and a metadata companion into a quarantine directory. Requires -Q / quarantine_dir and root. The original pathname is retained by default.

Quarantine directory requirements (when action=quarantine):

  • Directory must already exist: owned by root:root, typically mode 0700 (no group or other permission bits).

  • Payload names look like basename.pidPID.XXXXXX; metadata is the same name plus .metadata (mode 0600).

  • Optional -B / backup_mapped_objects=true: after kill and executable evidence, best-effort copy of mapped file objects (capped; not a package default).

  • Optional -U / unsafe_quarantine_source_removal=true: after durable evidence, attempt deletion of the source pathname only. Accepts a remaining pathname race; not recommended as a package default.

Examples (foreground / one-shot for testing; services usually use a config file—see below):

# Detect only (default)
memscan -f -a log ...

# Pause (SIGSTOP) on FOUND
memscan -f -a stop ...

# Kill on FOUND
memscan -f -a kill ...

# Quarantine (kill + evidence); directory must exist first
mkdir -m 0700 /var/quarantine/memscan
memscan -f -a quarantine -Q /var/quarantine/memscan ...

Exemptions

Operator exemptions suppress stop / kill / quarantine after a FOUND; they do not suppress scanning or FOUND logging. Lists are repeatable and may be comma-separated:

Option / key

Meaning

-u / exempt_user

Exempt real UID (account name or numeric UID). Effective UID does not grant exemption.

-e / exempt_pid

Exempt PIDs (PID 1 always exempt).

-n / exempt_name

Exempt executable basenames (not a strong security boundary).

-H / trusted_hash_file

File of SHA-256 digests (64 hex digits per line); matching content skips response actions only.

-C / allow_container

Linux: allow actions inside exact cgroup paths (otherwise actions are refused in non-host PID namespaces).

-z / allow_zone

Solaris: allow actions in named/numeric non-global zones (otherwise refused outside the global zone).

Command-line options

Use memscan -h on the agent for the authoritative list. Summary:

Option

Description

-f

Remain in the foreground (required under systemd and SMF).

-1

Scan one procfs snapshot and exit (implies -f).

-l MODE

syslog (default) or console (troubleshooting; needs foreground / one-pass).

-s PATH

Local clamd Unix socket.

-m MODE

Local mode: auto (default), instream, or pathname scan (Unix socket only).

-t HOST

Remote/local TCP clamd; content sent with INSTREAM.

-P PORT

TCP port with -t (default 3310).

-T MS

Clamd socket deadline (default 30000).

-W MS

Local clamd readiness wait at startup (default 30000).

-L BYTES

Cache memory budget (default 16777216; minimum 65536).

-p PATH

Alternate procfs root (default /proc).

-i MS

Poll interval (1–3,600,000 ms).

-q

Suppress clean-result logs; FOUND is always logged.

-c FILE

Load all settings from a config file; cannot be combined with other options.

-d FILE

Read local clamd configuration for scan-size policy tracking.

-R FILE

Standalone: enforce mandatory local clamd settings (cannot combine with other options).

-M SIZE

Fallback / remote scan-size limit (default 100M).

-a ACTION

log, stop, kill, or quarantine (default log).

-Q PATH

Quarantine directory (required for quarantine).

-B

After quarantine, back up mapped objects (async; capped).

-U

Unsafe opt-in: delete source path after durable quarantine evidence.

-u / -e / -n / -H / -C / -z

Exemptions and container/zone allow lists (see above).

-V / -h

Version / help.

-s and -t are mutually exclusive. -m is valid only with a Unix socket. A bare -P without -t is rejected.

Configuration file

Preferred way to set non-default policy (including response actions) under a service: put settings in a regular file and run memscan -c /path/to/memscan.conf. When -c is used it must be the only command-line option; include foreground=true for service use.

Rules:

  • One key=value per line; # comments and blank lines allowed.

  • Booleans are true or false.

  • Scalar keys once only (replace action=log when changing action; do not duplicate it).

  • Exemption keys may be repeated; comma-separated lists are combined.

  • As root, the file must be a regular file (not a symlink), root-owned, and not group/other-writable.

Example detect-only remote/TCP layout (adjust host/port for the site):

foreground=true
log_destination=syslog
scan_once=false
action=log
clamd_host=127.0.0.1
clamd_port=3310
max_scan_size=100M
clamd_timeout_ms=30000
poll_interval_ms=250
log_clean_results=false

Example explicit quarantine opt-in (replace the action=log line; do not add a second action):

foreground=true
action=quarantine
quarantine_dir=/var/quarantine/memscan
backup_mapped_objects=false
unsafe_quarantine_source_removal=false
clamd_host=127.0.0.1
clamd_port=3310

Common keys (see memscan -h / package notes for the full set):

foreground, log_destination, scan_once, clamd_socket, local_scan_mode, clamd_config, restart_clamd_on_config_change, clamd_restart_command, clamd_host, clamd_port, max_scan_size, cache_memory_limit_bytes, clamd_timeout_ms, clamd_startup_timeout_ms, proc_root, poll_interval_ms, log_clean_results, action, quarantine_dir, backup_mapped_objects, unsafe_quarantine_source_removal, trusted_hash_file, exempt_user, exempt_pid, exempt_name, allow_container, allow_zone.

Applying under the service

Stock units often start memscan -f with compiled defaults (action=log). To use a config file:

Linux (systemd drop-in):

[Service]
ExecStart=
ExecStart=/usr/sbin/memscan -c /etc/memscan.conf

Then systemctl daemon-reload and restart memscan.

Solaris (SMF): point the start method at memscan -c ... (or extend the method/properties for the site). Restart with svcadm restart application/memscan. Current SMF properties commonly cover TCP host/port, optional Unix socket, and poll interval; response actions belong in a -c config unless the site method is extended to pass -a / -Q.

After changing action or quarantine settings, restart memscan so the new policy loads.