MediumCompromise indicatorsBLWK-AV-002

ClamAV signature database is stale

What this means

ClamAV's signature database is ‹db age days› days old. An installed but outdated scanner gives a false sense of coverage — it won't catch anything discovered since the last update.

How to fix it

Run freshclam (or check that the freshclam timer/service is enabled: systemctl status clamav-freshclam).

Check it yourself

Run a scan and look for BLWK-AV-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads clamav_status and reports this check when:

db_age_days > 14

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005