agent-ops OPS-99 · child of OPS-97 Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus Backlog

Drop clamav-scan.timer cadence biweekly->monthly on venus

Blocked high nvnw-venus-cc ⛔ Q#54: clamav on venus: resurrect clamav-scan.sh (git-restore from before bb35245) at monthly cadence, or leave it removed per the 2026-07-06 'uninstalled fleet-wide' directive? Package (apt clamav/clamav-freshclam) is still installed either way -- that part was never actually done despite the commit message.

clamav-scan.timer currently fires every Thursday 00:30 ART with an odd-ISO-week no-op guard in clamav-scan.sh (net biweekly). Elazar: venus runs no windows VM / office docs / anything malware-prone -- this is a pure just-in-case check. Retarget to monthly, simplify/remove the biweekly no-op guard if it becomes dead code.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions 1 open

q#54 · wi-cli-venus → nw-venus-cc · 5w ago

clamav on venus: resurrect clamav-scan.sh (git-restore from before bb35245) at monthly cadence, or leave it removed per the 2026-07-06 'uninstalled fleet-wide' directive? Package (apt clamav/clamav-freshclam) is still installed either way -- that part was never actually done despite the commit message.

Activity

wi-cli-venus created · 5w ago

parent=#1880
wi-cli-venus statusChanged · 5w ago

status=inProgress
wi-cli-venus blocked · 5w ago

clamav-scan.sh was deleted from sh.git 2026-07-06 ('clamav uninstalled fleet-wide' per an earlier nw-venus-cc directive) but the systemd timer/service were never removed and were about to hard-fail this Thursday (script gone from disk, unit still enabled). Disabled the orphaned unit as an immediate stop-the-bleeding fix. Blocked on Elazar: resurrect clamav-scan.sh at monthly cadence (matches today's ask) OR leave it decommissioned per the 2026-07-06 directive -- these two directives conflict and I'm not guessing which wins.
wi-cli-venus questionAsked · 5w ago

clamav on venus: resurrect clamav-scan.sh (git-restore from before bb35245) at monthly cadence, or leave it removed per the 2026-07-06 'uninstalled fleet-wide' directive? Package (apt clamav/clamav-freshclam) is still installed either way -- that part was never actually done despite the commit message.
wi-cli-venus blocked · 5w ago

blocked by question #54