clamd problem after cpanel update

[sozotech]

I believe clamav was updated this morning when cpanel updated to 11.48.1 (build 1). Now I cannot get clamd to start. I tried the following.

/usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/scripts/restartsrv_clamd

clamd seems to run for about 20-30 seconds then exits. I tried restarting exim and I see the following error message.

service exim restart
Shutting down clamd:                                       [FAILED]
Shutting down exim:                                        [  OK  ]
Shutting down spamd:                                       [FAILED]
Starting clamd: rm: cannot remove `/var/clamd': Is a directory
ERROR: LOCAL: Socket file /var/clamd could not be removed: Is a directory
                                                           [FAILED]
Starting exim:                                             [  OK  ]

So on this server, I see /var/clamd is indeed a directory.

ll /var | grep clam
drwxr-xr-x    2 root  root   4096 Feb 26 01:51 clamd/

On another server /var/clamd is a socket.

ll /var | grep clam
srw-rw-rw-    1 root  root      0 Feb 26 02:57 clamd=

So I just removed the /var/clamd diretory which was empty and restarted and now it appears to be working. Anyone have any clue why this would happen?

Best regards,
Eric

 

[cPanelMichael]

Hello

I am happy to see you were able to address the issue. cPanel should not have configured "/var/clamd" as a directory. Is it possible you installed a custom instance of ClamAV at some point in the past that created the directory?

Thank you.

 

[sozotech]

Hello

I am happy to see you were able to address the issue. cPanel should not have configured "/var/clamd" as a directory. Is it possible you installed a custom instance of ClamAV at some point in the past that created the directory?

Thank you.

No it should be the built in ClamAV. This system updated to 11.48.1 build 2 this morning and it broke again because their was a /var/clamd directory present. I just removed the directory again and restarted to get it working again.

Eric

 

[cPanelMichael]

I'm not seeing this behavior on a test machine. Could you open a support ticket so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[Seff]

Had similar issue on cPanel 11.50.0.27. Clamd starts fine when exim is restarted, but it keep failing after a while along with email alert "The service “clamd” appears to be down"

Tried to restart Clamd using /usr/local/cpanel/scripts/restartsrv_clamd, got following error:

Service Error
    The “clamd” service failed because it cannot find the “/var/clamd” socket.

clamd has failed. Contact your system administrator if the service does not automagically recover.

There was no file or directory as /var/clamd:

# ll /var/clamd
/bin/ls: /var/clamd: No such file or directory

Tried creating an empty file /var/clamd:

# touch /var/clamd

# ll /var/clamd
-rw-r--r-- 1 root root 0 MMM hh mm:ss /var/clamd

Then attempted a restart of clamd:

# /usr/local/cpanel/scripts/restartsrv_clamd
Waiting for “clamd” to restart ………waiting for “clamd” to initialize ……
…finished.

Service Status
    clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 350988 (pidfile check method).

clamd restarted successfully.

# ll /var/clamd
srw-rw-rw- 1 root root 0 MMM dd hh:mm /var/clamd=

 

[cPanelMichael]

Do you have any other third-party installations of ClamAV on this system (e.g. through source or RPM)? If you uninstall ClamAV via "WHM >> Manage Plugins" can you find any active instances of ClamAV on your system?

Thank you.

 

[tc0]

Same story here. I touched the filename to fix it:

[email protected] [/etc]# /usr/local/cpanel/scripts/restartsrv_clamd
Service Error
The “clamd” service failed because it cannot find the “/var/clamd” socket.

clamd has failed. Contact your system administrator if the service does not automagically recover.
[email protected] [/etc]# ls -l /var/cla*
/bin/ls: /var/cla*: No such file or directory
[email protected] [/etc]# touch /var/clamd
[email protected] [/etc]# /usr/local/cpanel/scripts/restartsrv_clamd
Waiting for “clamd” to restart ………waiting for “clamd” to initialize ……
…finished.

Service Status
clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 12200 (pidfile check method).

clamd restarted successfully.

 

[cPanelMichael]

New Same story here. I touched the filename to fix it:

Were you able to verify if there were any other third-party installations of ClamAV on the system?

Thank you.