HIDS 11257

Rule ID

11257

Status

Active rule currently published.

Description

This rule is detects when proftp tries to connect to the antimalware daemon, clamd, and can not do this. These means the antimalware daemon is not running, or something is preventing the FTP daemon from talking to it.

Check to make sure clamd is running. Log into the ASL GUI and check that CLAMAV_ENABLED is set to yes.

False Positives

There is no known false positive for this rule.

If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

Tuning Recommendations

None.

Similar Rules

None.

Knowledge Base Articles

None.

Outside References