clamd failed to start, error 255

[Techs-Y]

Hello!

After the last cPanel update we have faced with clamd issue -- it doesn't running.

Firstly we have tried to move bytecode, daily, and main from /usr/local/cpanel/3rdparty/share/clamav/ to backup folder and than run

/usr/local/cpanel/3rdparty/bin/freshclam

*** no errors ***

/scripts/restartsrv_clamd

*** no errors ***

Everything seems ok, but it was enough only for several hours and than it goes down again. We have repeated actions, but:

/usr/local/cpanel/3rdparty/bin/freshclam

*** no errors ***

/scripts/restartsrv_clamd

Service “clamd” is already stopped.

Waiting for “clamd” to start ………failed.

Cpanel::Exception::Services::StartError

Service Status

Service Error

(XID zcvenn) The “clamd” service failed to start.

clamd has failed. Contact your system administrator if the service does not automagically recover.

Memory:

# sar -r

Linux 2.6.32-754.15.3.el6.x86_64 10/30/2019 _x86_64_ (4 CPU)

12:00:01 AM kbmemfree kbmemused %memused kbbuffers kbcached kbcommit %commit

12:10:01 AM 952220 3103984 76.52 62716 1018880 12632748 178.42

12:20:01 AM 1234124 2822080 69.57 44272 888660 12281800 173.47

12:30:01 AM 797116 3259088 80.35 48592 939368 12600232 177.96

12:40:01 AM 126668 3929536 96.88 18992 1028688 12517476 176.80

12:50:01 AM 622956 3433248 84.64 54456 998888 12141228 171.48

Average: 746617 3309587 81.59 45806 974897 12434697 175.63

Logs from /var/log/messages:

Oct 30 01:19:36 pro kernel: [4037637.415386] Out of memory: Kill process 28913 (clamd) score 78 or sacrifice child

Oct 30 01:19:36 pro kernel: [4037637.416184] Killed process 29171, UID 0, (clamd) total-vm:942892kB, anon-rss:766884kB, file-rss:336kB

and in /var/log/chkservd.log :

The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 255 when it ended.

Could you please tell, whether this issue is produced due to recent update or it is memory lack issue (please pay attention, that this problem didn't appear before last update)?

What is the best way to fix for such situation?

 

[cPanelLauren]

From the output in the logs, you're providing it seems pretty clear that the issue is memory usage. Also, the %commit in the sar output would indicate that you're consistently utilizing a large amount of memory.