Bug Report Template
Description
Fresh install of ApisCP on Rocky 10 everything works great for about a day until clamav somehow autoupdates. When it autoupdates, the clamav version does not start anymore. To fix it I have to do dnf remove clamav and than reinstall it with dnf install clamav (along with the signatures and modsecurity connector) which fixes the issue when I do dnf install it downgrades the dependencies.
Steps to Reproduce
Step 1: Install on new sever (Rocky 10), everything works great.
Step 2: After about 1-2 days, the ClamAV version autoupdates.
Step 3 : After the update, ClamAV fails to start.
Step 4: I check the version and it is a newer version than previously.
Step 5: If I remove the package and than reinstall via dnf, it reinstalls the older version and I am able to restart the ClamAV process from the ApisCP dashboard.
Step6: It auto updates the ClamAV to a newer version after about a day and it fails to start. I noticed it crashed from the ApisCP dashboard where it shows all the apps running (MySQL, Apache, ClamAV etc.)
Expected Behavior
Updates to a compatible newer version and does not crash, it starts normally.
Actual Behavior
ClamAV crashes and wont start after it autoupdates.
Environment
ApisCP version: cpcmd misc:cp-version
revision: d96f3eb1367df2527c4f787624c61ed4e8e55e72
timestamp: 1757444750
ver_maj: 3
ver_min: 2
ver_patch: 48
ver_pre: 14-gd96f3eb13
dirty: false
debug: false
Operating System: uname -r
6.12.0-55.29.1.el10_0.x86_64
Additional relevant information (e.g., PHP version, database, etc.):
The working version is clamav-1.4.2-1.el10_0.x86_64
Additional Information
Provide any additional information about the bug, such as error messages, logs, screenshots, or any other relevant details.
That’s all I have for now. Thanks! - Andy
journalctl -n50 -u clamd@scan
I bet you’ll seeing something like,
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Main process exited, code=killed, status=9/KILL
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Failed with result 'oom-kill'.
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Consumed 22.470s CPU time, 1.4G memory peak, 568.>
Sep 12 12:33:31 localhost.localdomain systemd[1]: clamd@scan.service: Scheduled restart job immediately on client reque>
Sep 12 12:33:31 localhost.localdomain systemd[1]: Starting clamd@scan.service - clamd scanner (scan) daemon...
When signatures are updated, a second instance of ClamAV is started before the old one terminates. Server would require more RAM to safely run 2 copies of ClamAV in this scenario, concurrent reloads disabled (see override instructions), or if you have a separate server - centralize ClamAV scanning on a single server.
So now it is at version clamav-1.4.3-1.el10_1.x86_64 and it crashes and can not start. I am running ApisCP on baremetal at 192gb of ram so I don’t think it would be a memory issue. here is the log file , i truncated it since it just repeats:
[root@zeus ~]# journalctl -n50 -u clamd@scan
Sep 11 06:38:47 hostname.tld systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
Sep 11 06:38:47 hostname.tld systemd[1]: Failed to start clamd@scan.service - clamd scanner (sca>
Sep 11 06:41:17 hostname.tld systemd[1]: clamd@scan.service: Start request repeated too quickly.
Sep 11 06:41:17 hostname.tld systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
Sep 11 06:41:17 hostname.tld systemd[1]: Failed to start clamd@scan.service - clamd scanner (sca>
Sep 11 06:43:46 hostname.tld systemd[1]: Starting clamd@scan.service - clamd scanner (scan) daem>
Sep 11 06:43:46 hostname.tld clamd[447805]: /usr/sbin/clamd: symbol lookup error: /lib64/libclam>
Sep 11 06:43:46 hostname.tld systemd[1]: clamd@scan.service: Control process exited, code=exited>
Sep 11 06:43:46 hostname.tld systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
Sep 11 06:43:46 hostname.tld systemd[1]: Failed to start clamd@scan.service - clamd scanner (sca>
Sep 11 06:45:16 hostname.tld systemd[1]: clamd@scan.service: Scheduled restart job, restart coun>
Sep 11 06:45:16 hostname.tld systemd[1]: Starting clamd@scan.service - clamd scanner (scan) daem>
Sep 11 06:45:16 hostname.tld clamd[447846]: /usr/sbin/clamd: symbol lookup error: /lib64/libclam>
Sep 11 06:45:16 hostname.tld systemd[1]: clamd@scan.service: Control process exited, code=exited>
Sep 11 06:45:16 hostname.tld systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
Sep 11 06:45:16 hostname.tld systemd[1]: Failed to start clamd@scan.service - clamd scanner (sca>
Sep 11 06:46:46 hostname.tld systemd[1]: clamd@scan.service: Scheduled restart job, restart coun>
Sep 11 06:46:46 hostname.tld systemd[1]: Starting clamd@scan.service - clamd scanner (scan) daem>
Sep 11 06:46:46 hostname.tld clamd[447905]: /usr/sbin/clamd: symbol lookup error: /lib64/libclam>
Sep 11 06:46:46 hostname.tld systemd[1]: clamd@scan.service: Control process exited, code=exited>
Sep 11 06:46:46 hostname.tld systemd[1]: clamd@scan.service: Failed with result 'exit-code'.
Sep 11 06:46:46 hostname.tld systemd[1]: Failed to start clamd@scan.service - clamd scanner (sca>
Also I am unable to run freshclam , I get this error:
[root@zeus ~]# freshclam
freshclam: symbol lookup error: /lib64/libclamav.so.12: undefined symbol: EVP_MD_CTX_get_size_ex, version OPENSSL_3.4.0
and here are the clam log at : /var/log/clamav/clamd.log
Thu Sep 11 05:20:29 2025 -> Database correctly reloaded (8895697 signatures)
Thu Sep 11 05:20:29 2025 -> Activating the newly loaded database...
Thu Sep 11 05:30:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 05:40:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 05:50:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 06:00:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 06:10:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 06:20:30 2025 -> SelfCheck: Database status OK.
Thu Sep 11 06:30:30 2025 -> SelfCheck: Database modification detected. Forcing reload.
Thu Sep 11 06:30:30 2025 -> Reading databases from /var/lib/clamav
Thu Sep 11 06:30:36 2025 -> Database correctly reloaded (8895945 signatures)
Thu Sep 11 06:30:36 2025 -> Activating the newly loaded database...
Thu Sep 11 06:33:19 2025 -> Pid file removed.
Thu Sep 11 06:33:19 2025 -> --- Stopped at Thu Sep 11 06:33:19 2025
Thu Sep 11 06:33:19 2025 -> Socket file removed.
# ldd /usr/bin/freshclam
libclamav.so.12 => /lib64/libclamav.so.12 (0x00007f4372000000)
...
libssl.so.3 => /lib64/libssl.so.3 (0x00007f1963348000)
Looks irregular from my angle.
Here’s my reference:
# rpm -q --queryformat="%{NAME} %{VERSION} %{BUILDHOST}\n" clamav-freshclam clamav
clamav-freshclam 1.4.2 buildvm-x86-26.iad2.fedoraproject.org
clamav 1.4.2 buildvm-x86-26.iad2.fedoraproject.org
# rpm -qf /lib64/libssl.so*
openssl-devel-3.2.2-16.el10.x86_64
openssl-libs-3.2.2-16.el10.x86_64
openssl-libs-3.2.2-16.el10.x86_64
Looks to be a bad build environment on EPEL upon further research, same issue on Alma.
Until things are sorted in both build environments -
dnf downgrade -y clamav-freshclam
dnf versionlock clamav-freshclam
If it’s still failing to start, take a look at journalctl but with more context - journalctl -n100 -u clamd@scan
1 Like
Thank you, the downgrade and versionlock fixes the issue. I really appreciate your help.