Add pacman/Arch Linux package detection support for Linux antivirus check
The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running.
We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.
Log in to comment and vote
Comments5
BryanK
Aug 24
Hi given this response was over 3 years ago, has there been an update on if there will be other linux system support?
Moritz L.
Aug 20
•Merged request
•3 votes
Arch Linux compatibe SecFix client
For our hardcore Linux fans, could you please implement an Arch Linux compatible version of the SecFix client.
Grigory Emelianov
Dec 13, 2022
Moritz L. which other solutions did you try to monitor Arch Linux? Why didn't other solutions work? How many users would require Arch Linux Agent?
Moritz L.
Dec 13, 2022
Grigory Emelianov: I have to admit, this is only one who wants to use it. Currently he is forced to use Ubuntu. I think you met him today.
Jan 12, 2023
We decided not to include this feature into the Q1 roadmap due to low demand. We would be happy to review it again if it resonates with more customers and users actively using Arch Linux.