SOLVED clamd not running after upcp --cron

[Trane Francks]

Greetings.

We're running a soon-to-be retired CloudLinux 5 server with WHM 56.0 (build 43). A few hours ago, upcp --cron ran and a few minutes later I began getting spammed with clamd down messages. Very concerning, I saw the following output from 'clamd --version':

ClamAV 0.99/23161/Fri Mar 3 11:58:43 2017

I decided to nuke the installation incl. databases and used '/scripts/check_cpanel_rpms --fix --targets=clamav' to reinstall, followed by 'freshclam'. Alas, this still does not have things running properly. '/etc/rc.d/init.d/exim restart' results in the following output:

Starting clamd: LibClamAV Error: cli_pcre_parse: PCRE compilation failed at offset 52: unrecognized character after (?<
LibClamAV Error: cli_pcre_build: failed to build pcre regex
ERROR: Database initialization error: Malformed database
​

clamd is still returning the same version information and clam is non-functional. How can I fix this?

​

 

[megahost]

getting the same problem here. only on servers still running Centos5 with or without Cloudlinux.
those running Centos 6 or 7 do not have this problem.

 

[TerranceR]

Hello,

This is due to an issue with a recently released ClamAV definition update, you can see further info on the ClamAV mailinglist @ [clamav-users] Daily 23161 broke Clam

ClamAV has pulled this bad signature update, you can update your ClamAV definitions by running "freshclam" and then restarting clamd via "/scripts/restartsrv_clamd"

 

[megahost]

Thanks Terrance, that worked.

 

[Trane Francks]

Thanks. Things are mostly back to normal, but for Service Status still showing clamd down. (It started correctly and appears to be running.)

 

[TerranceR]

Thanks. Things are mostly back to normal, but for Service Status still showing clamd down. (It started correctly and appears to be running.)

Hello,

It may take about 10 minutes for Service Status/chkservd to update accordingly, if it does not update by then, feel free to submit or update your ticket.

 

[Trane Francks]

Thanks, Terrance. In the end, it took a reboot to get the status to return to normal. All seems fine now.