ClamAV is a powerful, open-source antivirus engine designed to detect malware, viruses, and trojans on Linux systems. If you have just installed it, you need to start its background services so that it can protect your system and keep its virus definitions up to date.

This guide will show you how to start, enable, and verify the ClamAV services using systemctl.

Prerequisites

Before running the commands, ensure you have:

• A Linux distribution installed.
• Administrative privileges (sudo or root access).

Step 1: Start the Antivirus Daemon

The primary service is clamav-daemon. This background process loads virus signatures into memory and handles on-access scanning. It also allows you to run high-speed scans using the clamdscan utility.

Run the following commands in your terminal:

• Start the service:

  sudo systemctl start clamav-daemon
  

• Enable it to start automatically on boot:

  sudo systemctl enable clamav-daemon
  

• Verify that it is running correctly:

  sudo systemctl status clamav-daemon
  

💡 Note: The daemon might take a few moments to change to an "active" status. This delay happens because it is loading a large database of malware definitions directly into your system's RAM.

Step 2: Start the Automatic Database Updater

An antivirus engine is only as good as its virus signatures. ClamAV uses a separate service called clamav-freshclam to look for and download the latest malware definitions automatically.

To get the updater running, execute these commands:

• Start the updater service:

  sudo systemctl start clamav-freshclam
  

• Enable the updater to start on boot:

  sudo systemctl enable clamav-freshclam
  

• Verify the update status:

  sudo systemctl status clamav-freshclam
  

Conclusion

Your Linux machine is now running ClamAV in the background with continuous, automated database updates. You can now safely run manual system scans or configure real-time protection.