clamd that performs on-access
    scanning under Linux and shares internal virus database
    with the daemon. By default, this thread will only notify you when
    potential threats are discovered. If you turn on prevention via
    clamd.conf then you must follow some important rules when
    using it:
    
clamd!) will not be able to detect any viruses. In the
	      result all infected mails may be delivered.
clamd.conf
	      OnAccessMountPath option. While this will disable on-access prevention,
	      it will avoid potential system lockups caused by fanotify's blocking
	      functionality.
max_user_watches value.
    
    $ sysctl fs.inotify.max_user_watches=<n>
    Where <n> is the new maximum desired.
    
clamd.conf:
    ScanOnAccess yes OnAccessMountPath /Similarly, to protect your home directory add the following lines to
clamd.conf:
    ScanOnAccess yes OnAccessIncludePath /home OnAccessExcludePath /home/user/temp/dir/of/your/mail/scanning/software OnAccessPrevention yesFor more configuration options, type 'man clamd.conf' or reference the example clamd.conf.
Cisco 2018-03-28