clamd is on-access scanning
    based on fanotify, included in Linux since kernel 2.6.36.
    This is not required to run clamd. At the moment the fanotify header is
    only avaliable for Linux.
    
clamd.conf and read the 
    5.3 section for on-access scanning usage.