zavd.conf

###############################################################################
##                                                                           ##
##                     Zoner AntiVirus configuration file                    ##
##                                                                           ##
###############################################################################

###############################################################################
# CONFIGURATION NOTES
#
# 1: Any changes will only take effect after restarting ZAVd:
#    /etc/init.d/zavd restart
#    or run /opt/zav/bin/zavd -c /opt/zav/etc --restart
#
# 2: You can use units of time (h, m, s, hr, min, sec) and size (GB, MB, kB, B)
#    for all appropriate fields:  1024 or 1024 B or 1 kB or 1kiB
#                                 300 or 300 s or 5 min, etc.


###############################################################################
# DAEMON SETUP
#
# This section configures general options of the ZAV daemon (ZAVd)
# and its modules.
# Any paths should not be shared with other ZAVd instances
# or any other applications due to possible access violations
# (except for PATH TMP).

# User and group to run ZAVd as. User is required, group is optional.
# We recommend you not to run ZAVd with root privileges.
# If you decide to change the user:group setting, please run the following:
#   chown user:group PATH_LIB PATH_LIB/zavdupd.ver
#   chown -R user:group PATH_RUN PATH_LOG
ZAVD_USER		= "zavd"
ZAVD_GROUP		= "zavd"

# You can define ZAVd process priority.
ZAVD_PRIORITY		= 0

# Directory with ZAV configuration files.
PATH_ETC		= "/etc/zav"

# Directory with ZAV libraries, has to be writable by ZAVD_USER.
PATH_LIB		= "/opt/zav/lib"

# Directory with ZAV logfiles, has to be writable by ZAVD_USER.
PATH_LOG		= "/var/log/zav"

# Directory with ZAV runtime files, has to be writable by ZAVD_USER.
PATH_RUN		= "/var/run/zav"

# Directory for ZAV tempfiles, has to be writable by ZAVD_USER.
PATH_TMP		= "/tmp"


###############################################################################
# SCANNING SETUP
#
# This section configures the file scanner

# Specifies the depth level of the scanning:
#   (FASTEST, NORMAL, ADVANCED or BRUTE)
# The level determines limits of memory, recursions etc.
SCAN_LEVEL		= NORMAL

# Do not terminate the scanning process if suspicious pattern is found.
# Continue in scanning until a particular virus is found.
SCAN_FULL		= NO

# Enable heuristic analysis
SCAN_HEURISTICS		= YES

# Enable PE EXE emulator to perform code analysis
SCAN_EMULATION		= YES

# Enable archives decompression
SCAN_ARCHIVES		= YES

# Enable runtime-packers decompression
SCAN_PACKERS		= YES

# Enable usage of Generic Detection Language
SCAN_GDL		= YES

# Enable phishing detection
SCAN_PHISHING		= NO

# Enable deep scan (not only first few MB)
SCAN_DEEP		= NO

# Set limit for maximal filesize for packed files, more will not be unpacked
# Comment out for no limit
SCAN_MAX_SIZE		= 128 MB

# Set limit for maximal file count for packed files, more are not checked
# Comment out for no limit
SCAN_MAX_FILES		= 128

# Set limit for maximal scan level inside nested archives
# Comment out for no limit
SCAN_RECURSION		= 16

# Maximal amount of seconds allowed for scanning a single file
SCAN_TIMEOUT		= 5 min

# Specifies how many scanning processes may run at a time
SCAN_INSTANCES		= 3

# Specifies the memory limit for each scanning process (32 MB minimum)
SCAN_MEMORY		= 128 MB


###############################################################################
# LOGGING SETUP
#
# This section configures ZAVd logging output.

# Send messages to a syslog daemon.
LOG_SYSLOG		= YES

# Syslog facility (e.g. mail, daemon, local0, ..).
LOG_SYSLOG_FACILITY	= daemon

# Save messages to a log file.
LOG_ZAVDLOG		= YES

# Maximum size of ZAVd logfile in bytes.
LOG_MAX_SIZE		= 128 MB

# Enable compression of ZAVd logging file when its size exceeds LOG_MAX_SIZE
LOG_ROTATE		= NO

# What type of scan results you want to log on ZAVd's side.
LOG_SCANERROR		= YES
LOG_CLEAN		= NO
LOG_INFECTED		= YES
LOG_PROBINFECTED	= NO
LOG_SUSPICIOUS		= NO
LOG_NONSTANDARD		= NO
LOG_UNKNOWN		= NO
LOG_TIMEOUT		= NO

# Log the duration of scan and the size of the scanned file/memory.
LOG_STATS		= NO

# Send messages to a tty.
#LOG_TTY			= ""


###############################################################################
# UPDATING SETUP
#
# ZAVd can update the antivirus system automatically.
# You have to fill your license key in the UPDATE KEY correctly to be allowed
# to download the update files.

# Enable automatic updating of Zoner AntiVirus
UPDATE_ENABLE		= YES

# Specifies the time between the update requests
UPDATE_INTERVAL		= 30 min

# Update server to log on to
UPDATE_SERVER		= "update.zonerantivirus.com"

# Your license key for accessing ZAV update
UPDATE_KEY		= ""

# Log update progress and up-to-date messages
UPDATE_VERBOSE		= NO


###############################################################################
# ZAV REPORTING SETUP
#
# ZAVd can send debugging information when a critical error (bug) occurs
# as well as suspicious files to be analyzed in order to inform ZAV laboratory
# about new virus epidemy. We recommend you to let these settings turned on.

# Enable error reporting
REPORT_ERRORS		= YES

# Enable virus samples reporting
REPORT_SAMPLES		= YES

# Enable LiveThreat reporting, note that LOG_INFECTED has to be set.
REPORT_STATS		= YES


###############################################################################
# INOTIFY MODULE SETUP
#
# The ZAVNotify module provides on-access functionality for ZAVd.
# It is based on iNotify notification system in the kernel
#
# You must specify a separate file for watched directories and their specific
# configuration to keep the main file clean.
#
# BEWARE: iNotify userspace functions require glibc-2.4, when missing
#         the module will be disabled.

# Enable iNotify module in ZAVd
ZAVNOTIFY_ENABLE		= NO

# The queue size for files awaiting to be scanned
ZAVNOTIFY_QUEUE_SIZE		= 4194304

# Directory to move infected files to (if action set to MOVE)
#ZAVNOTIFY_DIRECTORY		= ""

# The configuration file for watched (and excluded) directories and their
# specific options
ZAVNOTIFY_CONFIG		= "zavnotify.conf.sample"


###############################################################################
# LMTP MODULE SETUP
#
# The LMTP module provides mailserver functionality to ZAVd.
#
# You can include a configuration file for each domain (with separate process).
# Each domain can have a different configuration (including scan options).
# In each file you must setup the connection with an MTA (like postfix)
# and actions to be taken when a scan result is received.

# Enable LMTP module in ZAVd
ZAVLMTP_ENABLE			= NO

# Domain configuration files
ZAVLMTP_DOMAIN			= zavlmtp.conf.sample


###############################################################################
# ICAP MODULE SETUP
#
# The ICAP module provides proxyserver functionality to ZAVd.
#
# You can include a configuration file for each proxy domain.
# Each domain can have a different configuration (including scan options).
# In each file you must setup the connection with a proxyserver (like squid)
# and actions to be taken when a scan result is received.

# Enable ICAP module in ZAVd
ZAVICAP_ENABLE			= NO

# Domain configuration files
ZAVICAP_DOMAIN			= zavicap.conf.sample


###############################################################################
# LD_PRELOAD MODULE SETUP
#
# The ZAVLD module provides an alternative on-access functionality for ZAVd.
# It is based on hooking close() calls via LD_PRELOAD variable.
# See man zavld(7) for more information.
#
# You must specify a separate file to set which files should be scanned
# and which scan configuration to use.

# Enable LD_PRELOAD module in ZAVd
ZAVLD_ENABLE			= NO

# For kernels older than 2.6.22 (you should consider upgrading anyway),
# /proc access is denied for setuid programs. This can overcome the problem.
# **WARNING** this option requires zavd to be started as root. All modules
# except this one will run as ZAVD_USER:ZAVD_GROUP, leaving zavd itself and
# this module running as root processes!
ZAVLD_PROC_WORKAROUND		= NO

# Directory to move infected files to (if action set to MOVE)
#ZAVLD_DIRECTORY			= ""

# How to react to locked files (by flock(), not fcntl(); see man zavd.conf(5)):
#   BLOCK  - treat the file as others, the client application can be blocked
#   UNLOCK - unlock all files first, can change the client's behaviour
#   SKIP   - test files for locks and skip flock-ed files
ZAVLD_FLOCK			= SKIP

# The configuration file for watched (and excluded) directories and their
# specific options
ZAVLD_CONFIG			= "zavld.conf.sample"