journalctl -n50 -u clamd@scan
I bet you’ll seeing something like,
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Main process exited, code=killed, status=9/KILL
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Failed with result 'oom-kill'.
Sep 12 12:33:30 localhost.localdomain systemd[1]: clamd@scan.service: Consumed 22.470s CPU time, 1.4G memory peak, 568.>
Sep 12 12:33:31 localhost.localdomain systemd[1]: clamd@scan.service: Scheduled restart job immediately on client reque>
Sep 12 12:33:31 localhost.localdomain systemd[1]: Starting clamd@scan.service - clamd scanner (scan) daemon...
When signatures are updated, a second instance of ClamAV is started before the old one terminates. Server would require more RAM to safely run 2 copies of ClamAV in this scenario, concurrent reloads disabled (see override instructions), or if you have a separate server - centralize ClamAV scanning on a single server.