The service clamd appears to be down

[Bloke2]

The last few days I started to get daily emails that say The service “clamd” appears to be down. Then it is followed up with email saying The service “clamd” is now operational. Is this something I can fix or be concerned with?

 

[cPanelLauren]

Hello Bloke2,

That really depends on "why" it's occurring. What's included in the email?

Thanks!

 

[Anupam SG]

@cPanelLauren is right on this one(as usual), the email will have the content mentioning why the service went down. My guess would be low memory on the server, since ClamAV uses a lot of memory when running.

 

[Bloke2]

The system’s command to check or to restart this service failed.

The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 255 when it ended

Used 2.51 GB
Available 5.49 GB

@cPanelLauren is right on this one(as usual), the email will have the content mentioning why the service went down. My guess would be low memory on the server, since ClamAV uses a lot of memory when running.

 

[cPanelLauren]

HI @Bloke2


It didn't provide any log output? What happens if you run the command:

/usr/local/cpanel/scripts/restartsrv_clamd

It doesn't look like a memory issue per say as you've got memory though you might want to run the following:

sar -r

To get an idea of historical memory usage, this isn't going to show you memory usage from beyond today though.

Thanks!

 

[Bloke2]

Waiting for “clamd” to stop ………finished.

Waiting for “clamd” to start ……waiting for “clamd” to initialize ………finished.

Service Status
clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID xxxxx (pidfile+/proc check method).

clamd restarted successfully.

HI @Bloke2


It didn't provide any log output? What happens if you run the command:

/usr/local/cpanel/scripts/restartsrv_clamd

It doesn't look like a memory issue per say as you've got memory though you might want to run the following:

sar -r

To get an idea of historical memory usage, this isn't going to show you memory usage from beyond today though.

Thanks!

 

[cPanelLauren]

Hi @Bloke2

And are you still receiving the notifications regularly that it's down and had to be restarted?


Thanks!

 

[Bloke2]

I was getting multiple emails saying it was down then recovered. Seems its fixed now from sunning that command yesterday. I just didn't know how to restart it. Thanks.

 

[cPanelLauren]

HI @Bloke2

If it happens again please feel free to open a ticket using the link in my signature so that we can take a closer look at your system to identify why the issue is occurring.

Thanks!

 

[Bloke2]

It started again. I opened a support ticket.

 

[cPanelLauren]

Hi @Bloke2

Can you give me the ticket ID for the support ticket so I can follow up with it?

Thanks!

 

[Bloke2]

Hi @Bloke2

Can you give me the ticket ID for the support ticket so I can follow up with it?

Thanks!

Support request ID is 10542801

 

[cPanelLauren]

Hi @Bloke2

I checked in on the ticket and it appears the analyst has found ClamD is being killed due to the server running out of memory. While it doesn't seem apparent at first that memory is being used, the VPS has no swap and memory is being cached causing a lack of availability. In order to resolve this issue, you'd need to increase the amount of memory available to the VPS, this would need to be done through your provider.

Thanks!

 

[Bloke2]

How much memory to I need? I have had this server for a couple years and it never did this before.

 

[rpvw]

I have had this server for a couple years and it never did this before.

Unfortunately, things don't stay the same for ever.

Updates and upgrades to the core system, services and hosted code can use more CPU and memory. If you were running just enough memory to cope; any update that suddenly started to use more would send the memory usage "over the top" and result in what you are experiencing.

How much memory to I need?

As for how much memory you might need - that is a bit like asking "how long is a bit of string", and is very much dependant on the number of websites you currently host and may intend to host in the future, the type of content the websites might deliver, the coding the websites may be written in, the SQL resources they might use, the number of simultaneous requests being made to the server ....... AND a healthy margin for core/services/cPanel/website updates and upgrades.

See Installation Guide - System Requirements - Version 74 Documentation - cPanel Documentation for the cPanel minimum recommendations.

I would recommend buying as much memory as you can afford - your whole server will run better and faster, and give your customers an altogether better experience.

 

[cPanelLauren]

Hi @Bloke2


I couldn't tell you that. It may be that something in the way the server is functioning is different, it could be that ClamAV is scanning more data, or that something else is consuming more memory than it was previously. I can only tell you that based on the errors on the server ClamD seems to be running properly and is being killed off due to being out of memory. I would suggest first asking the analyst in the ticket to confirm that Clamd is running properly and then speaking to your provider or system administrator on how to move forward.


Thanks!

 

[Bloke2]

Nothing major has been changed in a couple years. I have not added and more websites and they are not very big. Is 8GB not enough?
Used 2.19 GB
Available 5.81 GB

 

[cPanelLauren]

Hi @Bloke2

We can't really tell you what is or is not enough for your server and its traffic. Again, you'd need to work with your provider or system administrator to evaluate the server's performance but I would also request that the analyst confirm with you first that clamd is functioning as expected.


Thanks!

 

[rpvw]

Nothing major has been changed in a couple years

Wow you must be running cPanel 11.52 or there about ! So you haven't updated cPanel, or the kernel, or any other RPM provided service like Apache, or allowed ClamAV to download any new signatures, or allowed Spamassassin to download any new rules, or updated any website content management components or add-ons ? ...... shall I go on ?

Things change ........ every update requires a re-assessment of the server requirements and resources to maintain an optimal (or even stable) service. Even an increase in the volume of mail that the server gets, or the number of visitors to the hosted websites; represents a change.

The fact that you keep quoting your memory to us is not going to help. You would need to know what is using up all your memory at the precise time that the clamd service falls over, and even if the reported memory is a fair and accurate representation of the situation on your VPS.

You might be doing a backup and getting hit by an avalanche of spam, and getting some distributed login attempt on a service at that moment - we don't know - you will have to work with your cPanel analyst and your provider as suggested by @cPanelLauren above, and then if you don't get any help from your provider, you may want to think about hiring a competent systems administrator to help you.

System Administration Services | cPanel Forums

 

[Bloke2]

I appreciate the positive support and the only way to learn is by asking questions. That is what the forum is for. Why do you assume I am using an old version of Cpanel? Is v74 an outdated release? What does error 255 mean?

The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 255 when it ended.

I have searched for other issues people have with clamd and they don't mention memory as the problem. *Please don't reply unless you have positive, constructive help or suggestions. Thank you.