Clamd will not start - The service “clamd” appears to be down.

Symptoms

ClamAV will not start:

# /scripts/restartsrv_clamd --status
(XID c76xrv) The “clamd” service is down.

Description 

Clamd requires a lot of RAM to start, cPanel recommends you have at least 3 GB of RAM if you intend to use Clamd. In most cases, if Clamd will not start, it's due to not having enough RAM allocated to the server. If the Linux kernel runs out of memory, it will begin killing processes to prevent the server from crashing

You can determine if this is happening by checking the system logs. 

CentOS 6:

# grep OOM /var/log/messages

Jun 21 02:05:47 test.example.com kernel: OOM killed process 16782 (clamd) total-vm:1075256kB, anon-rss:946176kB, file-rss:8kB

CentOS 7: 

You can use the method above to check for the OOM messages, however, if you suspect this is happening, but it's not logged in the system log you're going to want to check the kernel log using journalctl: 

# journalctl -k | grep OOM

Jun 21 02:05:47 test.example.com kernel: OOM killed process 16782 (clamd) total-vm:1075256kB, anon-rss:946176kB, file-rss:8kB

If you're not using persistent logging in journald, you will only see kernel entries from the latest boot.

Workaround

 Increase the amount of RAM allocated to your server

Related documentation:

Configure ClamAV Scanner

Journald