Hello.
I installed freshclam and other clam* packages from EPEL on a Rocky 10 OS.
$ rpm -qa | grep clam
clamav-filesystem-1.4.2-1.el10_0.noarch
clamav-lib-1.4.2-1.el10_0.x86_64
clamav-1.4.2-1.el10_0.x86_64
clamd-1.4.2-1.el10_0.x86_64
clamav-data-1.4.2-1.el10_0.noarch
clamav-unofficial-sigs-7.2.5-12.el10_0.noarch
clamav-freshclam-1.4.2-1.el10_0.x86_64
I enabled syslog with local6 facility.
# grep ^Log /etc/freshclam.conf
LogSyslog yes
LogFacility LOG_LOCAL6
While watching journalctl -f on a terminal with
# journalctl -o verbose --output-fields=PRIORITY,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID,TRANSPORT,MESSAGE -f
I started the freshclam service on another terminal
# systemctl start clamav-freshclam
In the logs I see
Tue 2025-10-21 15:40:33.205606 CEST [s=a71935f911c545998e59e112bcb5327b;i=910;b=17c41c9cd6834b9a82b32511d01404ab;m=16b34052b6;t=641ab58145966;x=7d3abb2fd36f0923]
PRIORITY=6
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=freshclam
MESSAGE=ClamAV update process started at Tue Oct 21 15:40:33 2025
Tue 2025-10-21 15:40:33.206788 CEST [s=a71935f911c545998e59e112bcb5327b;i=911;b=17c41c9cd6834b9a82b32511d01404ab;m=16b3405754;t=641ab58145e04;x=3251f4e457307428]
PRIORITY=6
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=freshclam
MESSAGE=daily.cld database is up-to-date (version: 27799, sigs: 2076979, f-level: 90, builder: svc.clamav-publisher)
Tue 2025-10-21 15:40:33.206850 CEST [s=a71935f911c545998e59e112bcb5327b;i=912;b=17c41c9cd6834b9a82b32511d01404ab;m=16b3405792;t=641ab58145e42;x=bebb1d2d71f8bcec]
PRIORITY=6
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=freshclam
MESSAGE=main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Tue 2025-10-21 15:40:33.206898 CEST [s=a71935f911c545998e59e112bcb5327b;i=913;b=17c41c9cd6834b9a82b32511d01404ab;m=16b34057c1;t=641ab58145e72;x=6ed1d1cec22bc708]
PRIORITY=6
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=freshclam
MESSAGE=bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
Shouldn’t it be SYSLOG_FACILITY=22 instead of 3?