Check the ClamAV syslog path before relying on Wazuh decoders

Bottom line: Check the actual ClamAV log destination before accepting the built-in integration. Preserve the source’s Linux syslog boundary instead of assuming that any file containing antivirus text is equivalent.

Source fact: documented behavior

The ClamAV logs collection guide enables LogSyslog true in the ClamAV configuration and describes forwarding those logs to /var/log/syslog.

That procedure relies on the Wazuh agent’s default reading of /var/log/syslog and calls for a ClamAV daemon restart after the setting changes.

The source limits its out-of-the-box ClamAV decoders to logs from that syslog path on Linux endpoints.

What the source does not establish

This article verifies the documented log route and decoder scope. It does not configure a complete scanning policy, guarantee malware detection or validate another operating system, custom log path or rewritten message format.

Applicability questions

• Where does the actual ClamAV service write its messages?
• Does the endpoint follow the documented Linux syslog route?
• What harmless service event can identify the handoff?
• What scanner and detection requirements need separate acceptance?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends proving the actual syslog handoff and built-in decoding separately from the organization’s antivirus scanning policy.

1. Inspect the actual endpoint configuration with the service owner and identify the current log destination. Compare it with the documented route before relying on a pre-existing Wazuh agent as proof of integration. If the deployment uses another path or transforms messages, retain that difference for a separate design review rather than claiming coverage from the source’s built-in decoder statement.
2. Prepare a harmless, approved ClamAV service observation for a disposable test endpoint. Review any restart allowance and preserve the previous log configuration before applying the documented setting. Keep the observation’s endpoint and time reference so the investigator can locate the corresponding raw message. Do not download malware simply to establish that the service’s logging path is connected.
3. Trace the raw syslog message and the resulting Wazuh processing evidence as separate checkpoints. Review any available decoded fields and rule result against the chosen event, without asserting that every ClamAV message must produce an alert. If the raw message arrives but the expected interpretation does not, preserve its exact format for the integration owner before changing scanner policy or broadening unrelated collection.

Verification and evidence

Proposed verification: locate the approved harmless service message at the documented endpoint path, then follow its actual Wazuh result. Retain the redacted raw record, endpoint identity and timestamps with any decoder or alert observation. Keep a custom-path case outside the built-in acceptance unless its separate review and test have actually been completed.

Ask the antivirus owner to assess scanning coverage through its own approved procedure rather than accepting log delivery as that result. No ClamAV restart, file scan, malware download or Wazuh integration test was performed for this article. The proposed path check supports only the observed collection route and message case, not a general detection guarantee.

Official references

• ClamAV logs collection — Wazuh; official product documentation.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.