Solaris configuration

Optional endpoint settings for AWPclamav (clamd) and memscan on Solaris 11.4 after the agent is installed. A basic agent install does not require ClamAV or memscan. Use these steps only when you want those features.

For install and registration, see Installation. For hub Anti-Virus / Memory Based Scanning policy, see Asset Management.

Packages and architecture

Use arch-matched packages (i86pc or sparc). Do not use *.all.pkg for native ELF packages.
AWPclamav (optional) provides SMF network/awpclamd.
memscan (optional) ships with awp-agent as /usr/sbin/memscan and SMF application/memscan (disabled by default).

When AWPclamav is in use, signatures live under /var/lib/clamav/. Hub-driven updates use /var/ossec/modules/clamav/freshclam. Solaris uses the Linux/Unix signature class only.

Syslog (recommended if using ClamAV or memscan)

By default, Solaris may not log ClamAV or memscan events into /var/adm/messages (which the agent reads). If you enable those optional features, ensure a line similar to:

vi /etc/syslog.conf
*.err;kern.debug;daemon.notice;mail.crit;*.info /var/adm/messages
svcadm restart svc:/system/system-log:default

Note

memscan FOUND lines are logged at daemon.alert and appear with the stock daemon.notice facility. If remote syslog bypasses /var/adm/messages, ensure the agent still receives those events.

Enable AWPclamav (clamd) (optional)

Install the arch-matched AWPclamav package if it is not already present.
Install or update signature databases under /var/lib/clamav/ so clamd can start.
Enable the service and confirm loopback TCP 3310:

svcadm enable -s network/awpclamd
svcs network/awpclamd
netstat -an -f inet | grep 127.0.0.1.3310

Expect STATE online and a LISTEN line for 127.0.0.1.3310. If the service stays in maintenance, fix signatures then svcadm clear network/awpclamd.

Enable memscan (optional)

memscan is optional and ships disabled. Enable it only if you want process executable scanning, and only after awpclamd is online on 127.0.0.1:3310. Enabling earlier leaves the SMF service disabled (leave_disabled).

svcadm enable -s application/memscan
svcs application/memscan
/usr/sbin/memscan -V
pgrep -lf /usr/sbin/memscan

memscan submits running executable content to clamd over TCP INSTREAM (127.0.0.1:3310). FOUND results are syslog’d and decoded on the hub as rule 52526. Package defaults keep action=log (detect only). Optional pause/stop, kill, quarantine, exemptions, and CLI / config options are documented in Memory Based Scanning (memscan).

Agent control

/etc/init.d/ossec-agent start|stop
/var/ossec/bin/ossec-control start|stop

Scheduled scans via the Atomic OSSEC API use clamdscan against a running awpclamd (only relevant when optional AWPclamav is enabled).