Skip to main content

Add pacman/Arch Linux package detection support for Linux antivirus check

The Linux antivirus check currently relies on package-inventory tables (deb_packages, rpm_packages, etc. via osquery), which have no equivalent for pacman-based distributions (Arch Linux, Manjaro, EndeavourOS, Omarchy, and others). As a result, any antivirus solution installed via pacman — including ClamAV, which is on your supported list — can never be detected, regardless of whether it's correctly installed and running.

We verified this on an Omarchy (Arch-based) device: ClamAV was installed, running, and actively detecting malware (confirmed via EICAR test), and the underlying osquery processes table showed clamd/freshclam running correctly — but no pacman_packages table exists for the compliance check to query against, so the device was flagged as having no antivirus.

5 comments

Log in to comment and vote

Comments5

  • BryanK

    •

    Aug 24

    Hi given this response was over 3 years ago, has there been an update on if there will be other linux system support?

  • Moritz L.

    •

    Aug 20

    •

    Merged request

    •

    3 votes

    Arch Linux compatibe SecFix client

    For our hardcore Linux fans, could you please implement an Arch Linux compatible version of the SecFix client.

    • Grigory Emelianov

      Team•

      Dec 13, 2022

      Moritz L. which other solutions did you try to monitor Arch Linux? Why didn't other solutions work? How many users would require Arch Linux Agent?

      • Moritz L.

        •

        Dec 13, 2022

        Grigory Emelianov: I have to admit, this is only one who wants to use it. Currently he is forced to use Ubuntu. I think you met him today.

    • Grigory Emelianov changed status to Closed
      Team•

      Jan 12, 2023

      We decided not to include this feature into the Q1 roadmap due to low demand. We would be happy to review it again if it resonates with more customers and users actively using Arch Linux.