4 # check_clamav_signatures - Nagios plugin to monitor ClamAV signatures are up to date.
6 # Released under the MIT License.
8 # https://github.com/tommarshall/nagios-check-clamav-signatures
16 CLAM_LIB_DIR=/var/lib/clamav
17 NUMERICAL_REGEX='^[0-9]+$'
26 echo "check_clamav_signatures $VERSION"
30 # Output usage information.
34 echo 'Usage: ./check_clamav_signatures [options]'
38 # Output help information.
46 ./check_clamav_signatures
49 -p, --path <path> path to ClamAV lib directory, if not $CLAM_LIB_DIR
50 -w, --warning <number> number of revisions sigs can be out of date (warning)
51 -c, --critical <number> number of revisions sigs can be out of date (critical)
52 -V, --version output version
53 -h, --help output help information
55 For more information, see https://github.com/tommarshall/nagios-check-clamav-signatures
64 while test $# -ne 0; do
67 -p|--path) CLAM_LIB_DIR=$1; shift ;;
68 -V|--version) version; exit ;;
69 -h|--help) help; exit ;;
70 -w|--warning) WARN_THRESHOLD=$1; shift ;;
71 -c|--critical) CRIT_THRESHOLD=$1; shift ;;
73 echo "UNKNOWN: Unrecognised argument: $ARG"
80 if ! [[ $WARN_THRESHOLD =~ $NUMERICAL_REGEX ]]; then
81 echo "UNKNOWN: Warning threshold must be numeric!"
84 if ! [[ $CRIT_THRESHOLD =~ $NUMERICAL_REGEX ]]; then
85 echo "UNKNOWN: Critical threshold must be numeric!"
93 # ensure we have executable dependencies
94 for dependency in cut host grep sigtool sed; do
95 if ! hash $dependency >/dev/null 2>&1; then
96 echo "UNKNOWN: Missing dependency: ${dependency}"
101 # ensure the clam lib dir exists
102 if [ ! -d "$CLAM_LIB_DIR" ]; then
103 echo "UNKNOWN: Unable to locate ClamAV lib directory"
107 # ensure we have a daily signatures file
108 if [ -e ${CLAM_LIB_DIR}/daily.cld ]; then
109 DAILY_SIGNATURES_PATH="${CLAM_LIB_DIR}/daily.cld"
110 elif [ -e ${CLAM_LIB_DIR}/daily.cvd ]; then
111 DAILY_SIGNATURES_PATH="${CLAM_LIB_DIR}/daily.cvd"
113 echo "UNKNOWN: Unable to locate installed daily signatures"
117 # ensure we have a main signatures file
118 if [ -e ${CLAM_LIB_DIR}/main.cvd ]; then
119 MAIN_SIGNATURES_PATH="${CLAM_LIB_DIR}/main.cvd"
120 elif [ -e ${CLAM_LIB_DIR}/main.cld ]; then
121 MAIN_SIGNATURES_PATH="${CLAM_LIB_DIR}/main.cld"
123 echo "UNKNOWN: Unable to locate installed main signatures"
127 # extract the daily signatures version
128 INSTALLED_DAILY_VERSION=$(sigtool -i ${DAILY_SIGNATURES_PATH} 2>/dev/null | grep Version | sed -e 's/Version: //')
129 if ! [[ $INSTALLED_DAILY_VERSION =~ $NUMERICAL_REGEX ]]; then
130 echo "UNKNOWN: Unable to establish installed daily signatures version"
134 # extract the main signatures version
135 INSTALLED_MAIN_VERSION=$(sigtool -i ${MAIN_SIGNATURES_PATH} 2>/dev/null | grep Version | sed -e 's/Version: //')
136 if ! [[ $INSTALLED_MAIN_VERSION =~ $NUMERICAL_REGEX ]]; then
137 echo "UNKNOWN: Unable to establish installed main signatures version"
141 # query the DNS record
142 DNS_TXT_RECORD=$(host -t txt current.cvd.clamav.net)
143 if [ $? -ne 0 ]; then
144 echo "UNKNOWN: DNS query to current.cvd.clamav.net failed"
148 # extract the current daily signatures version from the DNS TXT record
149 CURRENT_DAILY_VERSION=$(echo $DNS_TXT_RECORD | cut -d : -f 3)
150 if ! [[ $CURRENT_DAILY_VERSION =~ $NUMERICAL_REGEX ]]; then
151 echo "UNKNOWN: Unable to establish current daily signatures version from DNS query"
155 # extract the current main signatures version from the DNS TXT record
156 CURRENT_MAIN_VERSION=$(echo $DNS_TXT_RECORD | cut -d : -f 2)
157 if ! [[ $CURRENT_MAIN_VERSION =~ $NUMERICAL_REGEX ]]; then
158 echo "UNKNOWN: Unable to establish current main signatures version from DNS query"
162 # determine the difference between the current and installed versions
163 DAILY_VERSION_DELTA=$((CURRENT_DAILY_VERSION-INSTALLED_DAILY_VERSION))
164 MAIN_VERSION_DELTA=$((CURRENT_MAIN_VERSION-INSTALLED_MAIN_VERSION))
166 if [ $DAILY_VERSION_DELTA -gt $CRIT_THRESHOLD -o $MAIN_VERSION_DELTA -gt $CRIT_THRESHOLD ]; then
167 echo "CRITICAL: Signatures expired;" \
168 "daily version: ${INSTALLED_DAILY_VERSION} (${DAILY_VERSION_DELTA} behind)," \
169 "main version: ${INSTALLED_MAIN_VERSION} (${MAIN_VERSION_DELTA} behind)"
171 elif [ $DAILY_VERSION_DELTA -gt $WARN_THRESHOLD -o $MAIN_VERSION_DELTA -gt $WARN_THRESHOLD ]; then
172 echo "WARNING: Signatures expired;" \
173 "daily version: ${INSTALLED_DAILY_VERSION} (${DAILY_VERSION_DELTA} behind)," \
174 "main version: ${INSTALLED_MAIN_VERSION} (${MAIN_VERSION_DELTA} behind)"
178 echo "OK: Signatures up to date;"\
179 "daily version: ${INSTALLED_DAILY_VERSION}," \
180 "main version: ${INSTALLED_MAIN_VERSION}"