FAILED clamd / clamd still running / cPanel monitoring

[Bdzzld]

I've noticed several times the last few months involving different cPanel servers, that after a daily nightly cPanel update, cPanel monitoring picks up that the clamd service is down, and starts e-mailing the following every five minutes :

The service “clamd” appears to be down.

Server

servername.domainname.xxx

Primary IP Address

111.222.333.444

Service Name

clamd

Service Status

failed â›”

Notification

The service “clamd” appears to be down.

Service Check Method

The system’s command to check or to restart this service failed.

Number of Restart Attempts

In such a case clamd apears to be running normally though :

[email protected] [~]# ps aux | grep clam
root      8480  0.3  0.3  97232 25944 ?        S    07:33   0:00 tailwatchd - chkservd - clamd check
root      8521  0.1  0.2  64928 22992 ?        S    07:33   0:00 /usr/local/cpanel/scripts/restartsrv_clamd --check --notconfigured-ok
root      8597  0.0  0.0 103308   880 pts/0    SN+  07:34   0:00 grep clam
root     10468  0.2  3.8 526276 307536 ?       SNsl 05:17   0:21 /usr/local/cpanel/3rdparty/bin/clamd

cPanel monitoring only stops e-mailing, after a manual restart of exim (which also restarts clamd).

Does any one else also have this problem and/or is this a known bug?

Thanking you in advance.

 

[cPanelMichael]

Hello,

Could you let us know the output of the "rpm -qa|grep clam" command? I've seen these types of issues in the past when multiple instances of ClamAV were installed on the system.

Thank you.

 

[Bdzzld]

Hi cPanelMichael,
It does not appear that way:

[email protected] [~]# rpm -qa|grep clam
cpanel-clamav-virusdefs-0.99-4.cp1156.x86_64
cpanel-clamav-0.99-4.cp1156.x86_64

Please note: This unusual behaviour only seems to appear after a nightly cPanel update. Last night cPanel was updated to WHM 56.0 (build 28) on this server. Another cPanel server did not have this problem this time, but has had the same problem in the past too.

 

[cPanelMichael]

Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[Bdzzld]

I just did (7605307).

 

[Bdzzld]

Updated: The problem could not be found. Monitoring of the clamdscan port has been activated at all cPanel servers which had this issue in the past. Hopefully this will result in a solution at a later time.