On-access scanning

An interesting feature of clamd is on-access scanning based on the Dazuko module, available from http://dazuko.org/. It is not required to run clamd - furthermore, you shouldn't run Dazuko on production systems. The special thread in clamd responsible for the communication with Dazuko is called "Clamuko" (due to the funny name of Dazuko) and it's only supported on Linux and FreeBSD. To compile dazuko execute:

	$ tar zxpvf dazuko-a.b.c.tar.gz
	$ cd dazuko-a.b.c
	$ make dazuko
	or
	$ make dazuko-smp (for smp kernels)
	$ su
	# insmod dazuko.o
	# cp dazuko.o /lib/modules/`uname -r`/misc
	# depmod -a

Depending on your Linux distribution you have to add a "dazuko" entry to /etc/modules or run the module during system's startup by adding

	modprobe dazuko

to some startup file. You must also create a new device:

	$ cat /proc/devices | grep dazuko
	254 dazuko
	$ su -c "mknod -m 600 /dev/dazuko c 254 0"

Now configure Clamuko in clamd.conf and read the 5.3 section.