I do not see two clamd processes running at the same time. I'm still not sure
why I'm getting the "socket in use error."
I have only been running the systemd service for clamav-daemon. Today I tried
stopping that service, and manually running clamd sudo -u clamav clamd
- The clamav.log shows it does not encounter the error "LOCAL: Socket file
/run/clamav/clamd.ctl is in use by another process."
- After the first "self check" an hour later, the log shows : "SelfCheck:
Database status OK."
I think running without --foreground=true prevents the "socket in use" error.
When I then run freshclam after clamd, via sudo -u clamav freshclam -d
- freshclam appears to operate normally
- clamd appears to continue to operate without error (I followed the log with
tail -f and saw no new output since the last "self check"
So I will try some more things and report back, but perhaps I can run the
clamav systemd services without the --foreground=true option and avoid this
socket error.
> with the Gnome Systemmonitor (maybe in your tools folder, its an onboard
> tool), you should find both tasks if you have twice
>
> big side note: you are not able to uninstall ClamAV 100% from your Ubuntu!
> You can unstall and purge all what you can find, but after restart type
> `clamav --version` in your terminal and you get the last installed version
> number back! So it is not complete uninstalled, and then you install the
> classical Linux deb package (which have complete different paths) and you got
> in result two different ClamAV installations (SELF TESTED) - the 0.103 from
> repositiory and e.g. 1.4.3 from the deb Package.
> Our Ubuntu ClamAV has complete deeply integrated structures and hardcoded
> paths in all ClamAV files, this do bite the installation from classic deb
> package!
On Monday, December 8th, 2025 at 2:52 AM, Newcomer01 <[email protected]>
wrote:
> with the Gnome Systemmonitor (maybe in your tools folder, its an onboard
> tool), you should find both tasks if you have twice
>
> [1]
>
> big side note: you are not able to uninstall ClamAV 100% from your Ubuntu!
> You can unstall and purge all what you can find, but after restart type
> `clamav --version` in your terminal and you get the last installed version
> number back! So it is not complete uninstalled, and then you install the
> classical Linux deb package (which have complete different paths) and you got
> in result two different ClamAV installations (SELF TESTED) - the 0.103 from
> repositiory and e.g. 1.4.3 from the deb Package.
> Our Ubuntu ClamAV has complete deeply integrated structures and hardcoded
> paths in all ClamAV files, this do bite the installation from classic deb
> package!
>
> Von / From: [1984-Server1
> Accompany303](mailto:[email protected])
> An / To: [Newcomer01](mailto:[email protected])
> Gesendet / Sent: Montag, Dezember 08, 2025 um 06:54 (at 06:54 AM) +0100
> Betreff / Subject: Re: [clamav-users] "socket in use" error after
> installing official clamav package
>
>> Thanks for your help. I think you are on the right track. However, I cannot
>> find a cron job for clamav-daemon. I looked in all my /etc/cron.daily
>> .hourly .monthly .weekly dirs and did not find anything with "clam" in the
>> name. I am new to using cron jobs so maybe I am missing something
>>
>> But I found the wrapper shell /etc/init.d/clamav-daemon you mentioned. It
>> does not have 0600 permission. It has 755 or -rwxr-xr-x permission
>>
>> For now I've disabled my systemd services for clamav-daemon which runs
>> clamd, and clamav-freshclam.
>>
>> How can I determine if a cron job is running clamd ahead of my systemd
>> clamav services?
>>
>> On Sunday, December 7th, 2025 at 4:22 PM, Newcomer01 via clamav-users
>> [<[email protected]>](mailto:[email protected])
>> wrote:
>>
>>> by default under Ubuntu (REGULAR AND LTS) you have a default cron job which
>>> starts clamav on bootup itself (see /etc/cron.daily, /etc/cron.weekly, so
>>> on) and then you do also manually the same, so you get 2 sock-files.
>>> Check if under /etc/init.d/ the wrapper shell clamav-daemon has the
>>> permission 0600 (no executuion permission).
>>> Rename in the default cron dirs (named in my first sentence) files like
>>> clamav-daemon.
>>> After that you must start clamd always byself in terminal or via a own
>>> cronjob on bootup e.g.
>>>
>>> DO NOT INSTALL THE CLASSICAL CLAM-AV UNDER UBUNTU, WE HAVE A SPECIAL
>>> "UBUNTURIZED" VERSION IN THE REPOSITORY! THE CLASSICAL deb. DO NOT WORK
>>> WELL ON UBUNTU!
>>> On Ubuntu 20.04 the current clamav is regular 0.103 ON LTS (READ:
>>> https://docs.clamav.net/faq/faq-eol.html), please upgrade to a new Ubuntu
>>> Version and then you will get a newer clamav version (1.4.3 or higher) then
>>> all should working again, if you install clamav out of our repository.
>>>
>>> Von / From: [Alex Via Clamav-Users](mailto:[email protected])
>>> An / To: [Newcomer01](mailto:[email protected])
>>> CC / CC: [1984-Server1
>>> Accompany303](mailto:[email protected])
>>> Gesendet / Sent: Sonntag, Dezember 07, 2025 um 22:24 (at 10:24 PM) +0100
>>> Betreff / Subject: [clamav-users] "socket in use" error after installing
>>> official clamav package
>>>
>>>> Problem:
>>>> When clamav-daemon.service runs, it always encounters the error "LOCAL:
>>>> Socket file /run/clamav/clamd.ctl is in use by another process." Then it
>>>> immediately restarts, and fails again after the signatures have been
>>>> loaded.
>>>>
>>>> Background:
>>>> I needed to upgrade clamav to 1.4.3 using the official deb package from
>>>> https://www.clamav.net/downloads
>>>>
>>>> I made sure I uninstalled the old clamav v0.103 from my distro (Ubuntu
>>>> 20.04).
>>>> I installed the clamav 1.4.3 .deb package and migrated clamd.conf and
>>>> freshclam.conf
>>>> I've done some other stuff that I can't quite recall, like fixing the path
>>>> to the databases that the services point to.
>>>>
>>>> I have found two sockets, and I thin one is from my distro's old
>>>> installation.
>>>> /var/run/clamav/clamd.ctl
>>>>
>>>> /run/clamav/clamd.ctl
>>>>
>>>> Since then I have updated clamd.conf to use LocalSocket
>>>> /run/clamav/clamd.ctl instead of the one under /var
>>>> But strangely, every time I start clamav-daemon.socket it creates both
>>>> socket files. They both have the same inode.
>>>>
>>>> Is there any way I can resolve this socket conflict?
>>>> Where is the 2nd socket file coming from?
>>>>
>>>> _______________________________________________
>>>>
>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>> Help us build a comprehensive ClamAV guide:
>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>
>>>> https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________
Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation
https://docs.clamav.net/#mailing-lists-and-chat
