-h, --help

Show general help information and exit. To display the help information on any command, use the following call:

-v, --version

Show information on the module version and exit

-d, --debug

Instructs to show debug information upon execution of the specified command. It cannot be executed if a command is not specified. Use the call

scan <path>

Purpose: To initiate the scan of the specified file or directory by Scanner.

Arguments:

<path>—path to the file or directory to be scanned (the path can be relative).

This argument may be omitted if you use the --stdin or the --stdin0 option. To specify several files that satisfy a certain criterion, use the find utility (see Usage Examples) and the --stdin or --stdin0 option.

Options:

-a [--Autonomous] runs an autonomous copy of scan engine and Scanner to perform the specified scan, terminating them after it is over. Note that threats detected during autonomous scanning will not be added to the common list of threats detected displayed by threats command (see below), and information on them will not be sent to the centralized protection server, if Dr.Web for Linux is controlled by it.

--stdin—get the list of paths to scan from the standard input string (stdin). Paths in the list need to be separated by the next line character ('\n').

--stdin0—get the list of paths to scan from the standard input string (stdin). Paths in the list need to be separated by the zero character NUL ('\0').

--Exclude <path>—an excluded path. The path can be relative and contains a file mask (with the following wildcards: '?' and '*', as well as symbol classes '[ ]', '[! ]', '[^ ]').

Facultative option; can be set more than once.

--Report <type>—specifies the type of scan report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

Default value: BRIEF

--ScanTimeout <number>—specify time-out to scan one file, in ms.

If the value is set to 0, time on scanning is not limited.

Default value: 0

--PackerMaxLevel <number>—set the maximum nesting level when scanning packed objects.

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--ArchiveMaxLevel <number>—set the maximum nesting level when scanning archives (zip, rar, and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--MailMaxLevel <number>—set the maximum nesting level when scanning email messages (pst, tbb, and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--ContainerMaxLevel <number>—set the maximum nesting level when scanning other containers (HTML and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--MaxCompressionRatio <ratio>—set the maximum compression ratio of scanned objects.

The ratio must be at least equal to 2.

Default value: 3000

--MaxSizeToExtract <size>—specify the maximum size for files enclosed in archives. Files whose size is greater than the value of this parameter will be skipped when scanning. There is no size limit for files in archives by default. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as size in bytes.

--HeuristicAnalysis <On|Off>—enable or disable heuristic analysis during the scanning.

Default value: On

--OnKnownVirus <action>—an action to perform upon detection of a known threat by using signature-based analysis.

Possible actions: Report, Cure, Quarantine, Delete.

Default value: Report

--OnIncurable <action>—an action to perform upon detection an incurable threat or when curing action (Cure) failed.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnSuspicious <action>—an action to perform upon detection of a suspicious object by heuristic analysis.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnAdware <action>—an action to perform upon detection of adware programs.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnDialers <action>—an action to perform upon detection of a dialer.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnJokes <action>—an action to perform upon detection of joke software.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnRiskware <action>—an action to perform upon detection of riskware.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnHacktools <action>—an action to perform upon detection of a hacktool.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--FollowSymlinks—resolve symlinks automatically

bootscan
<disk drive> | ALL

Purpose: Start scanning boot records on the specified disks via the Scanner. Both MBR and VBR records are scanned.

Arguments:

<disk drive>—path to the block file of a disk device whose boot record you want to scan. You can specify several disk devices separated by spaces. The argument is mandatory. If ALL is specified instead of the device file, all boot records on all available disk devices will be checked.

Options:

-a [--Autonomous] runs an autonomous copy of the scan engine and the Scanner to perform the specified scan, terminating them after it is over. Note that threats detected during autonomous scanning will not be added to the common list of detected threats displayed by threats command (see below), and information on them will not be sent to the centralized protection server, if Dr.Web for Linux is controlled by it.

--Report <type>—specifies the type of scan report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

Default value: BRIEF

--ScanTimeout <number>—specify time-out to scan one file, in ms.

If the value is set to 0, time on scanning is not limited.

Default value: 0

--HeuristicAnalysis <On|Off>—enable or disable heuristic analysis during the scanning.

Default value: On

--Cure <Yes|No>—enable or disable attempts to cure detected threats.

If the value is set to No, only a notification about a detected threat is displayed.

Default value: No

--ShellTrace—enable display of additional debug information when scanning a boot record.

procscan

Purpose: Initiates scanning of executables containing the code of currently running system processes with the Scanner. If a malicious executable file is detected, it is neutralized, and all processes run by this file are forced to terminate.

Arguments: None.

Options:

-a [--Autonomous] runs an autonomous copy of the scan engine and the Scanner to perform the specified scan, terminating them after it is over. Note that threats detected during autonomous scanning will not be added to the common list of detected threats displayed by threats command (see below), and information on them will not be sent to the centralized protection server, if Dr.Web for Linux is controlled by it.

--Report <type>—specifies the type of scan report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

Default value: BRIEF

--ScanTimeout <number>—specify time-out to scan one file, in ms.

If the value is set to 0, time on scanning is not limited.

Default value: 0

--HeuristicAnalysis <On|Off>—enable or disable heuristic analysis during the scanning.

Default value: On

--PackerMaxLevel <number>—set the maximum nesting level when scanning packed objects.

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--OnKnownVirus <action>—an action to perform upon detection of a known threat by using signature-based analysis.

Possible actions: Report, Cure, Quarantine, Delete.

Default value: Report

--OnIncurable <action>—an action to perform upon detection an incurable threat or when curing action (Cure) failed.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnSuspicious <action>—an action to perform upon detection of a suspicious object by heuristic analysis.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnAdware <action>—an action to perform upon detection of adware programs.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnDialers <action>—an action to perform upon detection of a dialer.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnJokes <action>—an action to perform upon detection of joke software.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnRiskware <action>—an action to perform upon detection of riskware.

Possible actions: Report, Quarantine, Delete.

Default value: Report

--OnHacktools <action>—an action to perform upon detection of a hacktool.

Possible actions: Report, Quarantine, Delete.

Default value: Report

remotescan
<host> <path>

Purpose: Initiates scanning of the specified file or directory on the specified remote host by connecting to it via SSH or Telnet.

Arguments:

<host>—IP address or a domain name of the remote host.

<path>—path to the file or directory to be scanned (the path must be absolute).

Options:

-m [--Method] <SSH|Telnet>—remote host connection method (protocol).

If method is not specified, SSH is used.

-l [--Login] <name>—login (user name) used for authorization on the remote host via the selected protocol.

If a user name is not specified, there will be an attempt to connect to a remote host on behalf of the user who has launched the command.

-i [--Identity] <path to file>—path to the file containing a private key used for authentication of the specified user via the selected protocol.

-p [--Port] <number>—number of the port on the remote host for connecting via the selected protocol.

Default value: default port for the selected protocol (22 for SSH, 23 for Telnet).

--ForceInteractive—use the SSH interactive session (only for SSH connections).

Optional feature.

--TransferListenAddress <address>—an address, listened to receive files transferred from the remote device for scanning.

Optional feature. If not indicated, an arbitrary address is used.

--TransferListenPort <port>—a port, listened to receive files transferred from the remote device for scanning.

Optional feature. If not indicated, an arbitrary port is used.

--TransferExternalAddress <address>—an address specified to the remote device to send files for scanning.

Optional feature. If not indicated, use the --TransferListenAddress value, or the outgoing address of the already established session.

--TransferExternalPort <port>—a port to transfer files for scanning, specified for the remote device.

Optional feature. If not indicated, an automatically determined port is used.

--Password <password>—password used for authentication of a user via the selected protocol.

Please note that the password is transferred as a plain text.

--Exclude <path>—the path to be excluded from scanning. The path can contain a file mask with the following allowed symbols: '?' and '*', as well as the symbol classes '[ ]', '[! ]', '[^ ]'. The path (including the path with the file mask) mast be absolute.

Facultative option; can be set more than once.

--Report <type>—specifies the type of scan report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

Default value: BRIEF

--ScanTimeout <number>—specify time-out to scan one file, in ms.

If the value is set to 0, time on scanning is not limited.

Default value: 0

--PackerMaxLevel <number>—set the maximum nesting level when scanning packed objects.

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--ArchiveMaxLevel <number>—set the maximum nesting level when scanning archives (zip, rar, and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--MailMaxLevel <number>—set the maximum nesting level when scanning email messages (pst, tbb, and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--ContainerMaxLevel <number>—set the maximum nesting level when scanning other containers (HTML and so on).

If the value is set to 0, nested objects will be skipped during scanning.

Default value: 8

--MaxCompressionRatio <ratio>—set the maximum compression ratio of scanned objects.

The ratio must be at least equal to 2.

--MaxSizeToExtract <size>—specify the maximum size for files enclosed in archives. Files whose size is greater than the value of this parameter will be skipped when scanning. There is no size limit for files in archives by default. The size is specified as a number with a suffix (b, kb, mb, gb). If no suffix is specified, the value is treated as size in bytes.

Default value: 3000

--HeuristicAnalysis <On|Off>—enable or disable heuristic analysis during the scanning.

Default value: On

checkmail
<path to file>

Purpose: Performs scan of an email message saved to a file for threats, signs of spam, malicious links, or non-compliance with rules of mail processing (using the emails processing component). The console output thread (stdout) will display the message scanning results and the action applied to this message while scanning by the email processing component.

Arguments:

<path to file>—path to file of the email message that requires scanning. Mandatory argument.

Options:

--Report <type>—specifies the type of scan report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

Default value: BRIEF

-r [--Rules] <list of rules>—indicate a list of rules to follow during an email message scanning.

If the rules are not indicated, the following set of rules used by default will be applied:

If Dr.Web Anti-Spam is not installed, the scanning rule for spam (the second string) will be automatically excluded from the set.

-c [--Connect] <IP>:<port>—indicate a network socket that will be used as an address for connection by a sender of the scanned message.

-e [--Helo] <name>—indicate an identifier of a client that sent a message (IP address or FQDN host, as for the SMTP command HELO/EHLO).

-f [--From] <email>—indicate an email address of a sender (as for the SMTP command MAIL FROM).

If the address is not indicated, the respective address from an email will be used.

-t [--Rcpt] <email>—indicate an email address of a recipient (as for the SMTP command RCPT TO).

If the address is not indicated, the respective address from an email will be used.

update

Purpose: Initiates updates of anti-virus components (virus databases, the scan engine, etc., depending on the distribution) from the Doctor Web update servers or the local cloud, terminates the updating process if already running, or performs rollback of the latest update to previous versions of the updated files.

Arguments: None.

Options:

-l [--local-cloud] uses the local cloud connected to Dr.Web for Linux to download the updates. If the option is not specified, the updates are downloaded from the Doctor Web update servers (default behavior).

--From <path>—apply updates from a specified directory offline.

--Path <path>—store files for updating offline in a specified directory; if this directory already has files, then they will be updated.

--Rollback—rollback the last update, and restore the previous version of files that have been updated during the last update.

--Stop—terminate the running updating process.

esconnect
<server>[:<port>]

Purpose: Connects Dr.Web for Linux to the specified centralized protection server (for example, Dr.Web Enterprise Server). For details on the operation modes, refer to the Operation Modes.

Arguments:

•<server>—IP address or network name of the host on which the centralized protection server is operating. This argument is mandatory.

•<port>—port number used by the centralized protection server. The argument is optional and should be specified only if the centralized protection server uses a non-standard port.

Options:

--Certificate <path>—a file path to a certificate of the centralized protection server, the connection to which will be established.

--Login <ID>—login (workstation identifier) used for connection to the centralized protection server.

--Password <password>—password for connection to the centralized protection server.

--Group <ID>—identifier of the group to which the workstation is added on connection.

--Rate <ID>—identifier of the tariff group applied to your workstation when it is included in one of the centralized protection server groups (can be specified only together with the --Group option).

--Compress <On|Off>—enables (On) or disables (Off) forced compression of transmitted data. If not specified, usage of compression is determined by the server.

--Encrypt <On|Off>—enables (On) or disables (Off) forced encryption of transmitted data. If not specified, usage of encryption is determined by the server.

--Newbie—connect as a “newbie” (get a new account on the server).

esdisconnect

Purpose: Disconnect Dr.Web for Linux from the centralized protection server and switch its operation to standalone mode.

Arguments: None.

Options: None.

cfset
<section>.<parameter> <value>

Purpose: To change the active value of the specified parameter in the current configuration of Dr.Web for Linux.

Arguments:

•<section>—name of the configuration file section where the parameter resides. This argument is mandatory.

•<parameter>—name of the parameter. The argument is mandatory.

•<value>—new parameter value. This argument is mandatory.

Options:

-a [--Add]—do not substitute the current parameter value but add the specified value to the list (allowed only for parameters that can have several values, specified as a list). You should also use this option to when adding a new parameter group identified by a tag.

-e [--Erase]—do not substitute the current parameter value but remove the specified value from the list (allowed only for parameters that can have several values, specified as a list).

-r [--Reset]—reset the parameter value to the default. At that, <value> is not required in the command and is ignored if specified.

Options are not mandatory. If they are not specified, then the current parameter value (the entire list of values, if the parameter currently holds several values) are substituted with the specified value.

cfshow
[<section>[.<parameter>]]

Purpose: Displays parameters of the current configuration of Dr.Web for Linux.

The command to display parameters is specified as follows <section>.<parameter> = <value>. Sections and parameters of non-installed components are not displayed.

Arguments:

•<section>—name of the configuration file section parameters of which are to be displayed. The argument is optional. If not specified, parameters of all configuration file sections are displayed.

•<parameter>—name of the displayed parameter. Optional argument. If not specified, all parameters of the section are displayed. Otherwise, only this parameter is displayed. If a parameter is specified without the section name, all parameters with this name from all of the configuration file sections are displayed.

Options:

--Uncut—display all configuration parameters (not only those used with the currently installed set of components). If the option is not specified, only parameters used for configuration of the installed components are displayed.

--Changed—display only those parameters whose values differ from the default ones.

--Ini—display parameter values in the INI file format: at first, the section name is specified in square brackets, then the section parameters listed as <parameter> = <value> pairs (one pair per line).

--Value—display only value of the specified parameter (the <parameter> argument is mandatory in this case).

reload

Purpose: Restarts Dr.Web for Linux service components. During the procedure, logs are reopened, the configuration file is reread, and the attempt to restart abnormally terminated components is performed.

Arguments: None.

Options: None.

threats
[<action> <object>]

Purpose: Apply the specified action to detected threats, selected by their identifiers. Type of the action is specified by the command option.

If the action is not specified, displays information on detected but not neutralized threats. The information on threats is displayed according the format, specified using the optional --Format option. If the --Format option is not specified, for each threat the following information is displayed:

•Identifier assigned to the threat (its ordinal number).

•The full path to the infected file.

•Information about the threat (name of the threat, threat type according to the classification used by the Doctor Web company).

•Information about the file: size, the file owner’s user name, the time of last modification.

•History of operations applied to the threat: detection, applied actions, and so on.

Arguments: None.

Options:

--Format "<format string>"—displays information on threats in the specified format. The description of format string is below.

If this option is specified along with any action options, it is ignored.

-f [--Follow]—wait for new messages about new threats and display them once they are received (CTRL+C interrupts the waiting).

If this option is specified along with any action options, it is ignored.

--Directory <list of directories>—displays only threats detected in files in directories from <list of directories>.

If this option is applied along with any options mentioned below, it is ignored.

--Cure <threat list>—attempt to cure the listed threats (list threat identifiers separating them with commas).

--Quarantine <threat list> moves the listed threats to quarantine (list threat identifiers are separated with commas).

--Delete <threat list>—delete the listed threats (list threat identifiers separating them with commas).

--Ignore <threat list>—ignore the listed threats (list threat identifiers separating them with commas).

If you need to apply the action to all detected threats, specify All instead of <threat list>. For example, the command:

moves all detected malicious objects to quarantine.

quarantine
[<action> <object>]

Purpose: Applies an action to the specified object in quarantine.

If an action is not specified, information on quarantined objects and their identifiers together with brief information on original files moved to quarantine is displayed. Information on isolated objects is displayed according a format, specified with optional --Format argument. If the --Format argument is not specified, for every isolated (quarantined) object the following information is displayed:

•Identifier assigned to the quarantined object.

•The original path to the file, before it was moved to quarantine.

•The date when the file was put in quarantine.

•Information about the file: size, the file owner’s user name, the time of last modification.

•Information about the threat (name of the threat, threat type according to the classification used by the Doctor Web company).

Arguments: None.

Options:

-a [--Autonomous] starts a separate instance of the Scanner to perform the specified quarantine command and terminate it upon completion.

This option can be applied along with any options mentioned below.

--Format "<format string>"—displays information on quarantined objects in the specified format. The description of format string is below.

If this option is specified along with any action options, it is ignored.

-f [--Follow]—wait for new messages about new threats and display them once they are received (CTRL+C interrupts the waiting).

If this option is specified along with any action options, it is ignored.

--Discovery [<list of directories>,] searches for quarantine directories in the specified list of directories and add them to the consolidated quarantine upon detecting a threat. If the <list of directories> is not specified, it searches for quarantine directories in the common locations of the file system (volume mounting points and user home directories).

This option can be specified not only with the -a (--Autonomous) option (see above), but also with any options/actions listed below. Moreover, if the quarantine command is launched as an autonomous copy, that is, with the -a (--Autonomous) option but without the --Discovery option, then it is equivalent to the call of:

--Delete <object>—delete the specified object from quarantine.

Note that objects are deleted from quarantine permanently—this action is irreversible.

--Cure <object>—try to cure the specified object in the quarantine.

Note that even if the object was successfully cured, it will remain in quarantine. To restore the cured object from quarantine, use the --Restore option.

--Restore <object>—restore the specified object from the quarantine to its original location.

Note that this command may require drweb-ctl to be started with root privileges. You can restore the file from quarantine even if it is infected.

--TargetPath <path>—restores an object from the quarantine to the specified location: either as a file with the name specified here (if the <path> is a path to a file), or just to the specified directory (if the <path> is a path to a directory). A path can be an absolute as well as relative (referring to a current directory).

Note that this option can only be used in combination with the --Restore option.

As an <object>, specify the object identifier in quarantine. To apply the action to all quarantined objects, specify All instead of <object>. For example, the command:

restores all quarantined objects and puts them in test subdirectory, located in a current directory, from which drweb-ctl command was launched.

Note that for the --Restore All variant the additional option --TargetPath, if specified, must set a path to a directory, not a path to a file.

%{n}

New string

%{t}

Tabulation

%{threat_name}

The name of detected threat (virus) according Doctor Web classification

%{threat_type}

Threat Type (“known virus”, and so on) according Doctor Web classification

%{size}

Original file size

%{origin}

The full name of the original file with path

%{path}

Synonym for %{origin}

%{ctime}

Date/time of original file modifying in "%Y-%b-%d %H:%M:%S" format (for example, "2018-Jul-20 15:58:01")

%{timestamp}

Similar to %{ctime}, but in the UNIX timestamp format

%{owner}

Username of the original file owner

%{rowner}

The remote user owner of the original file (if not applicable or value is unknown it is replaced with ?)

%{hid}

The identifier of the threat record in the history of events associated with the threat

%{tid}

The threat identifier

%{htime}

Date/time of the event related to a threat

%{app}

The identifier of the Dr.Web for Linux component which processed a threat

%{event}

The latest event related to a threat:

•FOUND—a threat was detected;

•Cure—a threat was cured;

•Quarantine—a file with threat was moved to quarantine;

•Delete—a file with threat was deleted;

•Ignore—a threat was ignored;

•RECAPTURED—a threat was detected again by an other component.

%{err}

Error message text (if no error is replaced with an empty string)

%{qid}

The identifier of quarantined object

%{qtime}

Date/time of moving the object to quarantine

%{curetime}

Date/time of curing attempt of the object moved to quarantine (if not applicable or value is unknown it is replaced with ?)

%{cureres}

The result of the quarantined object curing attempt:

•cured—a threat is cured;

•not cured—a threat was not cured or no curing attempts were performed.

appinfo

Purpose: Output information on the active Dr.Web for Linux components.

The following information is displayed about each component that is currently running:

•Internally-used name.

•Process identifier GNU/Linux (PID).

•State (running, stopped, and so on).

•Error code, if the work of the component has been terminated because of an error.

•Additional information (optional).

For the configuration daemon (drweb-configd) the following is displayed as additional information:

•The list of installed components—Installed.

•The list of components which must be launched by the configuration daemon—Should run.

Arguments: None.

Options:

-f [--Follow]—waits for new messages on module status change and display them once such a message is received (CTRL+C interrupts the waiting).

baseinfo

Purpose: Display the information on the current version of the scan engine and status of virus databases.

The following information is displayed:

•Version of the scan engine.

•Date and time when the virus databases that are currently used were issued.

•The number of available virus records (in the virus databases).

•The time of the last successful update of the virus databases and of the scan engine.

•The time of the next scheduled automatic update.

Arguments: None.

Options:

-l [--List]—displays the full list of downloaded files of virus databases and number of virus records in each file.

certificate

Purpose: Displays contents of the trusted Dr.Web certificate used by Dr.Web for Linux to scan protected connections if this option is enabled on the settings page. To save the certificate to the <cert_name>.pem file, you can use the following command:

Arguments: None.

Options: None.

events

Purpose: Viewing the Dr.Web for Linux events. Apart from that, the command allows you to manage events (mark as read, remove).

Arguments: None.

Options:

--Report <type>—specify the type of event report.

Allowed values:

•BRIEF—brief report.

•DEBUG—detailed report.

•JSON—a serialized report in JSON format.

-f [--Follow]—waits for new events and displays them upon emergence (CTRL + C interrupts the standby).

-s [--Since] <date, time>—shows the events that occurred before the specified timestamp (<date, time> is specified as YYYY-MM-DD hh:mm:ss).

-u [--Until] <date, time>—shows the events that occurred no later than the specified timestamp (<date, time> is specified as YYYY-MM-DD hh:mm:ss).

-t [--Types] <type list>—shows only events of the specified types (separated by commas).

The following event types are available:

•Mail—indicates that a threat has been detected in an email;

•UnexpectedAppTermination—unexpected shutdown of a component.

To view all types of events, use All.

--ShowSeen—displays of already read events as well.

--Show <list of events>—displays the listed events (event identifiers are separated by commas).

--Delete <list of events>—removal of listed events (event identifiers are separated by commas).

--MarkAsSeen <list of events>—marks the listed events as read (event identifiers are separated with a comma).

If you want to mark as “read” or delete all events, specify All instead of <events list>. For example, the command:

will mark as “read” all existing events.

report <type>

Purpose: Create a report on Dr.Web for Linux events in the HTML format (the page body is output to the specified file).

Arguments:

<type>—event type that required reporting (indicate one type). See possible values in the --Types option description of the events command above. A mandatory argument.

Options:

-o [--Output] <path to file>—save the report to the specified file. The option is mandatory.

-s [--Since] <date, time>—reports events that occurred no earlier than the specified timestamp (<date, time> is specified as YYYY-MM-DD hh:mm:ss).

-u [--Until] <date, time>—reports the events that occurred no later than the specified timestamp (<date, time> is specified as YYYY-MM-DD hh:mm:ss).

--TemplateDir <path to directory>—a path to the directory that contains HTML report templates.

Options -s, -u, and --TemplateDir are not mandatory. For example, the following command

generates a report on all existing email message threat detection events, based on the default template, and saves the result in the report.html file in the current directory.

license

Purpose: Show the information about the currently active license, or get a demo-version license, or get the key file for a license that has already been registered (for example, that has been registered on the company website).

If no options are specified, then the following information is displayed (if you are using a license for the standalone mode):

•License number.

•Date and time when the license expires.

If you are using a license provided to you by the centralized protection server (for the use of the product in the centralized protection mode or in the mobile mode), then the appropriate message will be displayed.

Arguments: None.

Options:

--GetDemo requests a demo key that is valid for one month. You receive the key if you meet the conditions for the provision of a demo period.

--GetRegistered <serial number>—get a license key file for the specified serial number, if the conditions for the provision of a new key file have not been breached (for example, breached by using the product not in the centralized protection mode, when the license is managed by a centralized protection server).

--Proxy http://<username>:<password>@<server address>:<port>— get a license key via the proxy server (used only with one of the previously mentioned options) — --GetDemo or --GetRegistered).

If the serial number is not the one provided for the demo period, you must first register it at the company website.

For further information on licensing of Dr.Web products, refer to the Licensing section.

log

Purpose: Displays the latest log records of Dr.Web for Linux on console screen (in the stdout thread), similar to tail command.

Arguments: None.

Options:

-s [--Size] <number>—the number of the last log records that are to be displayed on a screen.

-c [--Components] <components list>—the list of component identifiers, which records are displayed. Identifiers are defined with comma separation. If the argument is not defined, all available records logged by all components are displayed.

Actual identifiers of the components installed (e.g. internal components names, displayed in log) you can define by using the appinfo command (see above).

-f [--Follow]—waits for new messages in log and display them once such a message is received (interrupt waiting by pressing CTRL+C).