HIDS 11257

From Atomicorp Wiki
Jump to: navigation, search

Rule ID



Active rule currently published.


This rule is detects when proftp tries to connect to the antimalware daemon, clamd, and can not do this. These means the antimalware daemon is not running, or something is preventing the FTP daemon from talking to it.

Check to make sure clamd is running. Log into the ASL GUI and check that CLAMAV_ENABLED is set to yes.

False Positives

There is no known false positive for this rule.

If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

Tuning Recommendations


Similar Rules


Knowledge Base Articles


Outside References

Personal tools