ClamAV EICAR test not triggering because clamd cache hides it
If repeated EICAR tests stop triggering, clamd cache may be hiding repeated detections.
Malware LabClamAVEICARMalware TestCacheWazuh
Problem
EICAR test triggers once, but repeated tests do not generate new alerts.
Why it happens
`clamd` may cache previous scan results, or the test file is not changing enough to trigger a new event.
Fix / Approach
Use timestamped filenames or modify the test path to force a new file event.
Command / Config
Example approach:
- create EICAR test file with a timestamped filename
- scan the file
- check ClamAV log
- check Wazuh alert
When to use
- Testing ClamAV
- Wazuh integration
- Malware lab detections
- Alerting flow
When not to use
- Production malware handling workflows