ClamAV is mostly for filtering things on mail servers or uploads to a shared resource like a wiki.

You can also use it as a system virus scanner, but most viruses it detects are Windows viruses.

Antivirus as a thing is mostly dead, or has morphed into more aggressive endpoint protection. In that sense ClamAV is mostly to scan for known malware in things like mail servers. Make sure people aren’t sending malicious stuff, albeit mostly low hanging fruit.

Nextcloud, wikis, or other similar aggregation sites are also a usecase, but again low hanging fruit.

Set up a cron job and have it run periodically, like once an hour / day / week, whatever. Make sure you set up something that alerts you if/when it hits on something.

I use it. I think it was a hardening recommendation from lynis IIRC.

I definitely experienced a lot more freezing on my laptop after installing it (it’s a memory hog) so I upped my swap and things are back to normal.

ClamAV is great for exactly one thing: checking the “has antivirus” checkbox on company security audits.

Don’t get me wrong, it’s a real AV product, but there’s no real need for it. You’ll get much better results just being careful about what you run and having a system and network firewall. And not running everything as root.

I do use ClamAV. Most users just run some sort of daily scan, but this is remedial and not preventative.

In order to truly harness clamav’s potential, you need to configure clamonacc on-access scanning. It passes items off to clamd with lowered privileges and prevents file access through inotify until its realtime scan has cleared.