[SOLVED] I found the real reason. It has nothing to do with the --foreground
flag, but with my systemd configuration of clamav. The clue was that clamav
works fine when I run it myself instead of through systemd.
The background is after uninstalling the Ubuntu clamav package and replacing it
with the official ClamAV debian package, I migrated the systemd clamav unit
files. However, I copied those unit files from my Debian server to my Ubuntu
machine, so I can't prove that they were configured the same as the old Ubuntu
systemd units for clamav, which I accidentally removed.
Regardless, the cause of the "socket in use" error was from a systemd unit file
that creates and starts listening on the socket called "clamav-daemon.socket"
```
[Unit]
Description=Socket for Clam AntiVirus userspace daemon
Documentation=man:clamd(8) man:clamd.conf(5) https://docs.clamav.net/
# Check for database existence
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}
[Socket]
ListenStream=/run/clamav/clamd.ctl
#ListenStream=1024
SocketUser=clamav
SocketGroup=clamav
RemoveOnStop=True
[Install]
WantedBy=sockets.target```
It turns out that clamd will create its own socket and this unit is not needed
(for my setup on my Ubuntu machine, at least).
However, the systemd unit for clamd itself has two directives that link it to
the clamav-daemon.socket unit.
Here is the contents of the clamav-daemon.service unit
```
[Unit]
Description=Clam AntiVirus userspace daemon
Documentation=man:clamd(8) man:clamd.conf(5) https://docs.clamav.net/
Requires=clamav-daemon.socket
# Check for database existence
ConditionPathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}
[Service]
ExecStart=/usr/local/sbin/clamd --foreground=true
# Reload the database
ExecReload=/bin/kill -USR2 $MAINPID
TimeoutStartSec=420
[Install]
WantedBy=multi-user.target
Also=clamav-daemon.socket```
Once I removed the Requires= and Also= directives and restarted the
clamav-daemon.service, I no longer got the socket error.
-----------------------
Sent with [Proton Mail](https://proton.me/mail/home) secure email.
On Sunday, December 14th, 2025 at 10:35 PM, Alex B <[email protected]>
wrote:
> I do not see two clamd processes running at the same time. I'm still not sure
> why I'm getting the "socket in use error."
> I have only been running the systemd service for clamav-daemon. Today I tried
> stopping that service, and manually running clamd sudo -u clamav clamd
>
> - The clamav.log shows it does not encounter the error "LOCAL: Socket file
> /run/clamav/clamd.ctl is in use by another process."
>
> - After the first "self check" an hour later, the log shows : "SelfCheck:
> Database status OK."
>
> I think running without --foreground=true prevents the "socket in use" error.
>
> When I then run freshclam after clamd, via sudo -u clamav freshclam -d
>
> - freshclam appears to operate normally
> - clamd appears to continue to operate without error (I followed the log with
> tail -f and saw no new output since the last "self check"
>
> So I will try some more things and report back, but perhaps I can run the
> clamav systemd services without the --foreground=true option and avoid this
> socket error.
>
>> with the Gnome Systemmonitor (maybe in your tools folder, its an onboard
>> tool), you should find both tasks if you have twice
>>
>> big side note: you are not able to uninstall ClamAV 100% from your Ubuntu!
>> You can unstall and purge all what you can find, but after restart type
>> `clamav --version` in your terminal and you get the last installed version
>> number back! So it is not complete uninstalled, and then you install the
>> classical Linux deb package (which have complete different paths) and you
>> got in result two different ClamAV installations (SELF TESTED) - the 0.103
>> from repositiory and e.g. 1.4.3 from the deb Package.
>> Our Ubuntu ClamAV has complete deeply integrated structures and hardcoded
>> paths in all ClamAV files, this do bite the installation from classic deb
>> package!
>
> On Monday, December 8th, 2025 at 2:52 AM, Newcomer01 <[email protected]>
> wrote:
>
>> with the Gnome Systemmonitor (maybe in your tools folder, its an onboard
>> tool), you should find both tasks if you have twice
>>
>> [1]
>>
>> big side note: you are not able to uninstall ClamAV 100% from your Ubuntu!
>> You can unstall and purge all what you can find, but after restart type
>> `clamav --version` in your terminal and you get the last installed version
>> number back! So it is not complete uninstalled, and then you install the
>> classical Linux deb package (which have complete different paths) and you
>> got in result two different ClamAV installations (SELF TESTED) - the 0.103
>> from repositiory and e.g. 1.4.3 from the deb Package.
>> Our Ubuntu ClamAV has complete deeply integrated structures and hardcoded
>> paths in all ClamAV files, this do bite the installation from classic deb
>> package!
>>
>> Von / From: [1984-Server1
>> Accompany303](mailto:[email protected])
>> An / To: [Newcomer01](mailto:[email protected])
>> Gesendet / Sent: Montag, Dezember 08, 2025 um 06:54 (at 06:54 AM) +0100
>> Betreff / Subject: Re: [clamav-users] "socket in use" error after
>> installing official clamav package
>>
>>> Thanks for your help. I think you are on the right track. However, I cannot
>>> find a cron job for clamav-daemon. I looked in all my /etc/cron.daily
>>> .hourly .monthly .weekly dirs and did not find anything with "clam" in the
>>> name. I am new to using cron jobs so maybe I am missing something
>>>
>>> But I found the wrapper shell /etc/init.d/clamav-daemon you mentioned. It
>>> does not have 0600 permission. It has 755 or -rwxr-xr-x permission
>>>
>>> For now I've disabled my systemd services for clamav-daemon which runs
>>> clamd, and clamav-freshclam.
>>>
>>> How can I determine if a cron job is running clamd ahead of my systemd
>>> clamav services?
>>>
>>> On Sunday, December 7th, 2025 at 4:22 PM, Newcomer01 via clamav-users
>>> [<[email protected]>](mailto:[email protected])
>>> wrote:
>>>
>>>> by default under Ubuntu (REGULAR AND LTS) you have a default cron job
>>>> which starts clamav on bootup itself (see /etc/cron.daily,
>>>> /etc/cron.weekly, so on) and then you do also manually the same, so you
>>>> get 2 sock-files.
>>>> Check if under /etc/init.d/ the wrapper shell clamav-daemon has the
>>>> permission 0600 (no executuion permission).
>>>> Rename in the default cron dirs (named in my first sentence) files like
>>>> clamav-daemon.
>>>> After that you must start clamd always byself in terminal or via a own
>>>> cronjob on bootup e.g.
>>>>
>>>> DO NOT INSTALL THE CLASSICAL CLAM-AV UNDER UBUNTU, WE HAVE A SPECIAL
>>>> "UBUNTURIZED" VERSION IN THE REPOSITORY! THE CLASSICAL deb. DO NOT WORK
>>>> WELL ON UBUNTU!
>>>> On Ubuntu 20.04 the current clamav is regular 0.103 ON LTS (READ:
>>>> https://docs.clamav.net/faq/faq-eol.html), please upgrade to a new Ubuntu
>>>> Version and then you will get a newer clamav version (1.4.3 or higher)
>>>> then all should working again, if you install clamav out of our repository.
>>>>
>>>> Von / From: [Alex Via
>>>> Clamav-Users](mailto:[email protected])
>>>> An / To: [Newcomer01](mailto:[email protected])
>>>> CC / CC: [1984-Server1
>>>> Accompany303](mailto:[email protected])
>>>> Gesendet / Sent: Sonntag, Dezember 07, 2025 um 22:24 (at 10:24 PM) +0100
>>>> Betreff / Subject: [clamav-users] "socket in use" error after installing
>>>> official clamav package
>>>>
>>>>> Problem:
>>>>> When clamav-daemon.service runs, it always encounters the error "LOCAL:
>>>>> Socket file /run/clamav/clamd.ctl is in use by another process." Then it
>>>>> immediately restarts, and fails again after the signatures have been
>>>>> loaded.
>>>>>
>>>>> Background:
>>>>> I needed to upgrade clamav to 1.4.3 using the official deb package from
>>>>> https://www.clamav.net/downloads
>>>>>
>>>>> I made sure I uninstalled the old clamav v0.103 from my distro (Ubuntu
>>>>> 20.04).
>>>>> I installed the clamav 1.4.3 .deb package and migrated clamd.conf and
>>>>> freshclam.conf
>>>>> I've done some other stuff that I can't quite recall, like fixing the
>>>>> path to the databases that the services point to.
>>>>>
>>>>> I have found two sockets, and I thin one is from my distro's old
>>>>> installation.
>>>>> /var/run/clamav/clamd.ctl
>>>>>
>>>>> /run/clamav/clamd.ctl
>>>>>
>>>>> Since then I have updated clamd.conf to use LocalSocket
>>>>> /run/clamav/clamd.ctl instead of the one under /var
>>>>> But strangely, every time I start clamav-daemon.socket it creates both
>>>>> socket files. They both have the same inode.
>>>>>
>>>>> Is there any way I can resolve this socket conflict?
>>>>> Where is the 2nd socket file coming from?
>>>>>
>>>>> _______________________________________________
>>>>>
>>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>> Help us build a comprehensive ClamAV guide:
>>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>>
>>>>> https://docs.clamav.net/#mailing-lists-and-chat_______________________________________________
Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation
https://docs.clamav.net/#mailing-lists-and-chat
