Re: ClamAV daemon restarts via/through systemd

It turns out everything is explainable if you investigate things properly.

The mysterious daemon restarts were down to users/developers running Ansible that either restarted the host after software installation (don't ask), or running Ansible that explicitly restarted the ClamAV daemon (I haven't worked out why they were doing this).

The logfile ownership thing after logrotation and "systemctl restart clamd@scan" was due to clamd starting as root and then dropping privs to clamscan ("User clamscan" as configured in the clamd.conf, although I'm not clear on the mechanism that this employs to do the chowning).

Sorry for the noise in what is usually a pretty signal-ly list.

Ben
--
Servers and Storage Team, UIS, University of Cambridge

-----Original Message-----
From: Andrew C Aitchison <[email protected]> 
Sent: 04 June 2025 11:39
To: Ben Argyle via clamav-users <[email protected]>
Cc: Ben Argyle <[email protected]>
Subject: Re: [clamav-users] ClamAV daemon restarts via/through systemd

On Mon, 2 Jun 2025, Ben Argyle via clamav-users wrote:

> We're running ClamAV on RHEL 8 from EPEL 8:
>
> clamd-1.0.8-1.el8.x86_64
> clamav-freshclam-1.0.8-1.el8.x86_64
> clamav-1.0.8-1.el8.x86_64
>
> I know it's old, but that's what we've got to work with.
> Anyway, we're seeing an issue where all of our clamd@scan daemons
> are restarting because of systemd, sometimes multiple times a day:

The Debian/Ubuntu and Cisco/ClamAV .debs are very different in
auxiliary files like their startup and rotate scripts.
IIRC the .rpms from RedHat/EPEL and Cisco/ClamAV also differ here too.

If you are using the EPEL set, I would ask there too.

-- 
Andrew C. Aitchison                      Kendal, UK
                    [email protected]
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat