clamav --multiscan

[ponasromas]

So, --multiscan flag does not work as maldet pass file list, instead of directories. Does someone managed to modify maldet to support --multiscan ?

[rfxn]

Thanks for the report.

LMD passes files to ClamAV via -f FILE_LIST (a pre-filtered file list generated by find). ClamAV's --multiscan flag only works with directory arguments, not file lists, so it's silently ignored in LMD's current pipeline.

The file-list approach is intentional — it applies LMD's ignore rules, size/depth limits, ownership filters, and stage coordination (e.g., excluding MD5 stage 1 hits from the ClamAV pass) before ClamAV ever sees the files. Switching to directory-based scanning with --multiscan would bypass all of that filtering and require duplicating LMD's filter logic via ClamAV's own --exclude/--include flags, which have different semantics.

Workaround available today: Run clamd as a daemon. LMD auto-detects a running clamd via clamselector() and uses clamdscan to delegate scans to the daemon's internal thread pool — achieving the same multi-threaded parallelism that --multiscan provides, without changing the file-list pipeline. This is the recommended approach for environments where ClamAV scan performance is a concern.

Marking this as deferred for review in a future release. A proper --multiscan integration would require rethinking the file-list pipeline, with limited incremental benefit over the existing clamd daemon path.