Overview
The ClamAV daemon fails to initialize when required anti-virus signature files are missing from the designated directory. This condition typically occurs when the FreshClam update service is unable to download or refresh the database, causing a systemd dependency check to fail.
Error Description
When querying the service status, the following error indicates that the required signature pattern was not found:
# systemctl status clamav-daemon
● clamav-daemon.service - Clam AntiVirus userspace daemon
Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/clamav-daemon.service.d
└─extend.conf
Active: inactive (dead) since Thu 2021-09-09 04:02:59 MDT; 16min ago
Condition: start condition failed at Thu 2021-09-09 04:08:49 MDT; 11min ago
└─ ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc} was not met
Docs: man:clamd(8)
man:clamd.conf(5)
https://www.clamav.net/documents/The daemon will remain inactive until valid signature files matching the pattern /var/lib/clamav/daily.{c[vl]d,inc} are successfully downloaded and placed in the target directory.
Troubleshooting Steps
To resolve this issue, manually trigger a signature update to verify connectivity and identify potential errors. Follow the procedure corresponding to your operating system distribution.
AlmaLinux/CloudLinux/RHEL
- Stop the automatic update service:
// first stop the freshclam service (Centos/RHEL/CloudLinux/AlmaLinux 8+ only)
systemctl stop clamav-freshclam- Run FreshClam manually to download signatures and check for errors:
// run the freshclam command to try to download the signatures and check for any errors
/usr/bin/freshclam -d --foreground=true- Restart the automatic update service:
// start up the freshclam service (Centos/RHEL/CloudLinux/AlmaLinux 8+ only)
systemctl start clamav-freshclam- Start the ClamAV daemon:
// try to start clamav
systemctl restart clamd@scanDebian/Ubuntu
- Stop the automatic update service:
// first stop the freshclam service
systemctl stop clamav-freshclam- Run FreshClam manually to download signatures and check for errors:
// run the freshclam command to try to download the signatures and check for any errors
/usr/bin/freshclam -d --foreground=true- Restart the automatic update service:
// start up the freshclam service
systemctl start clamav-freshclam- Start the ClamAV daemon:
// try to start clamav
systemctl restart clamav-daemonCommon Issues & Best Practices
If manual updates fail, review the following common causes and operational guidelines:
- Rate Limiting (HTTP 429): ClamAV enforces strict download limits. Executing FreshClam more than once per hour will trigger a rate limit error. The service automatically checks DNS to determine if an update is required before initiating a download.
# /usr/bin/freshclam -d --foreground=true
Thu Sep 9 04:22:56 2021 -> ClamAV update process started at Thu Sep 9 04:22:56 2021
Thu Sep 9 04:22:57 2021 -> ^Can't download daily.cvd from https://database.clamav.net/daily.cvd
Thu Sep 9 04:22:57 2021 -> ^FreshClam received error code 429 from the ClamAV Content Delivery Network (CDN).
Thu Sep 9 04:22:57 2021 -> This means that you have been rate limited by the CDN.
Thu Sep 9 04:22:57 2021 -> 1. Run FreshClam no more than once an hour to check for updates.
Thu Sep 9 04:22:57 2021 -> FreshClam should check DNS first to see if an update is needed.
Thu Sep 9 04:22:57 2021 -> 2. If you have more than 10 hosts on your network attempting to download,
Thu Sep 9 04:22:57 2021 -> it is recommended that you set up a private mirror on your network using
Thu Sep 9 04:22:57 2021 -> cvdupdate (https://pypi.org/project/cvdupdate/) to save bandwidth on the
Thu Sep 9 04:22:57 2021 -> CDN and your own network.
Thu Sep 9 04:22:57 2021 -> 3. Please do not open a ticket asking for an exemption from the rate limit,
Thu Sep 9 04:22:57 2021 -> it will not be granted.
Thu Sep 9 04:22:57 2021 -> ^You are on cool-down until after: 2021-09-09 08:22:57
Thu Sep 9 04:22:57 2021 -> main database available for download (remote version: 61)- End-of-Life Operating Systems: ClamAV will block signature downloads if the underlying operating system is no longer supported or has reached end-of-life. Ensure your OS version is current and receiving security updates. For further details, refer to: Fixing Anti-Virus Signature Service Stopping Errors.
- Network Configuration: Verify that outbound HTTPS traffic to database.clamav.net is not blocked by a firewall, proxy, or DNS resolution issue.
