freshclam is ClamAV's virus database update tool and reads it's configuration from the file 'freshclam.conf' (this may be overridden by command line options). Freshclam's default behavior is to attempt to update databases that are paired with downloaded cdiffs. Potentially corrupted databases are not updated and are automatically fully replaced after several failed attempts unless otherwise specified.

Here is a sample usage including cdiffs:
$ freshclam

ClamAV update process started at Mon Oct  7 08:15:10 2013
main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo)
Downloading daily-17945.cdiff [100%]
Downloading daily-17946.cdiff [100%]
Downloading daily-17947.cdiff [100%]
daily.cld updated (version: 17947, sigs: 406951, f-level: 63, builder: neo)
Downloading bytecode-227.cdiff [100%]
Downloading bytecode-228.cdiff [100%]
bytecode.cld updated (version: 228, sigs: 43, f-level: 63, builder: neo)
Database updated (2831219 signatures) from (IP:
For more detailed help, type 'man clamscan' or 'clamscan -help'.

Cisco 2018-03-28