#1069825 clamav-daemon stops working with LibClamAV Error: cl_engine_addref: engine == NULL

Package:
clamav
Source:
clamav
Description:
anti-virus utility for Unix - command-line interface
Submitter:
Michael Braun
Date:
2024-05-04 11:42:04 UTC
Severity:
normal
#1069825#5
Date:
2024-04-25 11:38:51 UTC
From:
To:
Hi,

I'm scanning incoming mails using clamav-daemon and clamav-milter.
From time to time, my mailserver stops working due to clamav-daemon locking up.

The clamav logs read:

   6889 Apr 25 11:28:12 gate clamd[939931]: Thu Apr 25 11:28:11 2024 -> !accept() failed: Too many open files
      1 Apr 25 11:32:11 gate systemd-journald[311]: Suppressed 490085 messages from clamav-daemon.service

(with many repetitions)

      1 Apr 25 11:33:41 gate clamd[939931]: LibClamAV Error: cl_engine_addref: engine == NULL
      1 Apr 25 11:33:41 gate clamd[939931]: Thu Apr 25 11:33:41 2024 -> !cl_engine_addref() failed
      1 Apr 25 11:33:41 gate clamd[939931]: Thu Apr 25 11:33:41 2024 -> !Command dispatch failed

(with many repetitions)

Workaround: systemctl restart clamav-daemon fixes the problem temporarely.
--- data dir ---
total 651604
-rw-r--r-- 1 clamav clamav   1411072 Feb 27 17:03 bytecode.cld
-rw-r--r-- 1 clamav clamav 201756160 Apr 25 11:17 daily.cld
-rw-r--r-- 1 clamav clamav        69 Sep 19  2021 freshclam.dat
-rw-r--r-- 1 clamav clamav 464053248 Sep 16  2021 main.cld
-rw------- 1 clamav clamav        69 Sep  5  2021 mirrors.dat
#1069825#10
Date:
2024-05-04 11:37:55 UTC
From:
To:
Hi,

My guess is that _something_ within clamd forgets to close a fd and then
you hit the limit followed by the fallout later on. 0.103.10 isn't the
latest version, it is 0.103.11 but judging from the changelog there
isn't anything that changed.

Now. You could look at /proc/$CLAMD_PID/fd/ and check what kind of fd is
raising. I have here 10 fds in total, your limit should be at 1024 so
you have an idea how danlging fd you should.
That 10 depends on your setup in terms of IP listeners and/ or IP. On
average it should remain constant except if it creates temporary files
during scans or opens sockets for clients. The files are visible in
/proc, sockets have just an inode number but `ss' will show you more
details here.
Once you identified those then I could start looking closer in the
source once I know where to look. The other alternative you have is to
update to Bookworm hoping that bug is gone.

Sebastian