Suddenly clamd stopped working
Answered
Since this night, suddenly clamd stopped working.
The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 255 when it ended.
I found an old post about that and tried that solution, which was to make a backup directory and then issue these commands:
mv /usr/local/cpanel/3rdparty/share/clamav/bytecode.cld /root/clamav-backup/
/usr/local/cpanel/3rdparty/bin/freshclam /scripts/restartsrv_clamd
That seemed to work fine:
/usr/local/cpanel/3rdparty/bin/freshclam /scripts/restartsrv_clamd
ClamAV update process started at Mon Mar 16 13:17:45 2026
daily database available for update (local version: 27941, remote version: 27942)
Current database is 1 version behind.
Downloading database patch # 27942...
Time: 0.3s, ETA: 0.0s [========================>] 1.93KiB/1.93KiB
Testing database: '/usr/local/cpanel/3rdparty/share/clamav/tmp.3623669d60/clamav-d6b892e4250377a79dbfd858e2757cc8.tmp-daily.cld' ...
Database test passed.
daily.cld updated (version: 27942, sigs: 355270, f-level: 90, builder: svc.clamav-publisher)
main.cld database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
bytecode database available for download (remote version: 339)
Time: 0.8s, ETA: 0.0s [========================>] 275.10KiB/275.10KiB
Testing database: '/usr/local/cpanel/3rdparty/share/clamav/tmp.3623669d60/clamav-18686a6d40fa6a5be90ce135fe467cc2.tmp-bytecode.cvd' ...
Database test passed.
bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
However, I still got messages the clamd service is down.
And now I got mails with other content:
Service Check Raw Output (XID wkyd6s) The “clamd” service is down.
The subprocess “/usr/local/cpanel/scripts/restartsrv_clamd” reported error number 255 when it ended.
Log Messages Mar 16 13:15:02 srv clamd[500895]: ERROR: Invalid argument passed to function
Mar 16 13:15:02 srv clamd[500895]: LibClamAV Error: cli_loaddbdir: error loading database /usr/local/cpanel/3rdparty/share/clamav/rfxn.hdb
Mar 16 13:15:02 srv clamd[500895]: LibClamAV Error: Can't load /usr/local/cpanel/3rdparty/share/clamav/rfxn.hdb: Invalid argument passed to function
Mar 16 13:15:02 srv clamd[500895]: LibClamAV Error: cli_loadhash: Problem parsing database at line 24712
Mar 16 13:15:02 srv clamd[500895]: LibClamAV Error: cli_loadhash: Malformed hash string at line 24712
It has all been working fine until last night, so looks to me as if some update messed things up. How can I fix this?
-
I might have found the culprit, at this moment I'm waiting if things will keep working.
I checked the rfxn.hdb file at line 24712 and it started with a frontslash instead of a number.
So I removed the frontslash and restarted clamd service.At this moment, the service is started and seems to keep working.
So this means most likely more people might encounter this problem because the rfxn.hdb file is corrupt.
Removing the slash would be a workaround. However, it should be reported to the creators of that database file.
0 -
Hmmz... Looks like it might be time related too. Maybe in that hour the file content changed or something else happened.
We got the updates on DA servers at 03:53 AM this night, which have a correct file.
The Cpanel update on our server was at 04:53 AM which has the file with the issue. Just checked Github and seen others with the same issue with that file.
So it's already reported.0 -
Hey hey! I checked a test server and I don't have the /usr/local/cpanel/3rdparty/share/clamav/rfxn.hdb file there after a clean install of ClamAV. Is it possible that was something custom that was added to your machine? The only other reference I see to that file is another user here:
1 -
Yep, you're quite correct. It's belonging to a customisation. Totally forgot about that, sorry.
I did some more investigation.
These rfxn.hdb and also rfxn.ndb files are used by Maldetect. We have that installed already for a longer time on all our servers.They use their own directory for the sigs, but can be added to Clamav and then Maldetect is used in combination with Clamav if installed.
This does not explain why earlier updates didn't include the problem in the file. But it is from Maldetect and the users reporting on GitHub maldetect, must be using Maldetect too.
However that is no part of cPanel. So it can be closed here.
0 -
I am not sure this conclusion is accurate. There is no reference to 'maldet' or rfxn.hdb in /usr/local/cpanel/3rdparty/share/clamav/ on the server I checked and clamd failing on multiple servers. The clamd.log showed ERROR: Invalid argument passed to function when it fails to start.
0 -
You might want to check the commands I did in the first post.
Only after these commands, there was a message from WHM about the failure mentioning the rfxn.hdb file. And that file is only used by Maldetect as far as I know.
So if you have an issue on multiple servers, then the following options are possible.
1.) You're using Maldetect.
2.) You're using Maldetects maldetect definitions as custom entries in your freshclam.conf
3.) Clamd is in your case stopping with error for another reason.You might want to check logs and do some tests (like the commands in my first post) to see what could be wrong.
Correct command order is:
mkdir /root/clamav-backupmv /usr/local/cpanel/3rdparty/share/clamav/bytecode.cld /root/clamav-backup/
/usr/local/cpanel/3rdparty/bin/freshclam /scripts/restartsrv_clamd
see if that works well. If yes, check if clamd still stops with errors.
If yes then maybe cPRex can help you further.In my case it was the rfxn.hdb causing the issue because I do use Maldetect.
My problem is over now, so my conclusion about my situation was accurate and to the point.
Your situation might differ and maybe different cause.0 -
I was referring to the conclusion cPRex arrived at not yours rhm.geerts. Specifically the suggestion that your issue is the only cause.
0 -
After being flooded with clamd down messages every 5 minutes all day I found this post.
I had tried many commands online and also uninstalled clam, reinstalled multiple times.I’ve just removed that 3rd party/share clam folder containing those files (which are not removed when uninstalling) and reinstalled, it started up straight away.
0 -
Glad I was able to help somebody with my post and solution then uk01. :)
1 -
Thank you @rhm.geerts : )
I am very grateful!For anyone else finding this, removing these files will get clamav up again, probably without even reinstalling.
I must say, the modified dates are suspicious, we don’t even use Maldet but may have done at some point before cpguard.
rfxn.hdb
16/03/2026,03:50-rW-r--F--
2.49 MB
园
rfxn.ndb
16/03/2026,03:50 -rW-r--r--
510.61 KB
팅
rfxn.yara
16/03/2026,03:50 -rW-r--r--
1.34 KB0 -
Ps I can confirm maldet is loaded but not active on the server despite the shared file modified dates of 3.50 am today.
0 -
Maldet only runs on cron, it's not resident active.
0 -
Ah, yes, there is a cron file still on the server.
0 -
Also RFXN/Maldet already fixed the issue with the file. The cause was found and problem fixed.
So new updates should not interfere anymore.0 -
Confirmed, running maldet replaces those files and clamd stays up. Thanks for your help!
0 -
You're welcome.
0
Please sign in to leave a comment.
Comments
16 comments