clamd problem after cpanel update

sozotech

Well-Known Member
Jul 26, 2013
107
5
68
cPanel Access Level
Root Administrator
I believe clamav was updated this morning when cpanel updated to 11.48.1 (build 1). Now I cannot get clamd to start. I tried the following.

Code:
/usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/scripts/restartsrv_clamd
clamd seems to run for about 20-30 seconds then exits. I tried restarting exim and I see the following error message.


Code:
service exim restart
Shutting down clamd:                                       [FAILED]
Shutting down exim:                                        [  OK  ]
Shutting down spamd:                                       [FAILED]
Starting clamd: rm: cannot remove `/var/clamd': Is a directory
ERROR: LOCAL: Socket file /var/clamd could not be removed: Is a directory
                                                           [FAILED]
Starting exim:                                             [  OK  ]

So on this server, I see /var/clamd is indeed a directory.

Code:
ll /var | grep clam
drwxr-xr-x    2 root  root   4096 Feb 26 01:51 clamd/
On another server /var/clamd is a socket.

Code:
ll /var | grep clam
srw-rw-rw-    1 root  root      0 Feb 26 02:57 clamd=
So I just removed the /var/clamd diretory which was empty and restarted and now it appears to be working. Anyone have any clue why this would happen?

Best regards,
Eric
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,229
463
Hello :)

I am happy to see you were able to address the issue. cPanel should not have configured "/var/clamd" as a directory. Is it possible you installed a custom instance of ClamAV at some point in the past that created the directory?

Thank you.
 

sozotech

Well-Known Member
Jul 26, 2013
107
5
68
cPanel Access Level
Root Administrator
Hello :)

I am happy to see you were able to address the issue. cPanel should not have configured "/var/clamd" as a directory. Is it possible you installed a custom instance of ClamAV at some point in the past that created the directory?

Thank you.
No it should be the built in ClamAV. This system updated to 11.48.1 build 2 this morning and it broke again because their was a /var/clamd directory present. I just removed the directory again and restarted to get it working again.

Eric
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,229
463
I'm not seeing this behavior on a test machine. Could you open a support ticket so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.
 

Seff

Registered
May 2, 2015
3
0
51
Kerala, India
cPanel Access Level
Root Administrator
Had similar issue on cPanel 11.50.0.27. Clamd starts fine when exim is restarted, but it keep failing after a while along with email alert "The service “clamd” appears to be down"

Tried to restart Clamd using /usr/local/cpanel/scripts/restartsrv_clamd, got following error:
Code:
Service Error
    The “clamd” service failed because it cannot find the “/var/clamd” socket.

clamd has failed. Contact your system administrator if the service does not automagically recover.
There was no file or directory as /var/clamd:
Code:
# ll /var/clamd
/bin/ls: /var/clamd: No such file or directory
Tried creating an empty file /var/clamd:
Code:
# touch /var/clamd

# ll /var/clamd
-rw-r--r-- 1 root root 0 MMM hh mm:ss /var/clamd
Then attempted a restart of clamd:

Code:
# /usr/local/cpanel/scripts/restartsrv_clamd
Waiting for “clamd” to restart ………waiting for “clamd” to initialize ……
…finished.

Service Status
    clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 350988 (pidfile check method).

clamd restarted successfully.

# ll /var/clamd
srw-rw-rw- 1 root root 0 MMM dd hh:mm /var/clamd=
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,229
463
Do you have any other third-party installations of ClamAV on this system (e.g. through source or RPM)? If you uninstall ClamAV via "WHM >> Manage Plugins" can you find any active instances of ClamAV on your system?

Thank you.
 

tc0

Member
Jul 20, 2003
9
0
151
Same story here. I touched the filename to fix it:

[email protected] [/etc]# /usr/local/cpanel/scripts/restartsrv_clamd
Service Error
The “clamd” service failed because it cannot find the “/var/clamd” socket.

clamd has failed. Contact your system administrator if the service does not automagically recover.
[email protected] [/etc]# ls -l /var/cla*
/bin/ls: /var/cla*: No such file or directory
[email protected] [/etc]# touch /var/clamd
[email protected] [/etc]# /usr/local/cpanel/scripts/restartsrv_clamd
Waiting for “clamd” to restart ………waiting for “clamd” to initialize ……
…finished.

Service Status
clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 12200 (pidfile check method).

clamd restarted successfully.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,229
463
New Same story here. I touched the filename to fix it:
Were you able to verify if there were any other third-party installations of ClamAV on the system?

Thank you.