Clamd.sock frequently vanishes

Nextcloud version (eg, 20.0.5): 22.1.1
Operating system and version (eg, Ubuntu 20.04): Debian 11.2 / Docker
Apache or nginx version (eg, Apache 2.4.25): Apache/2.4.48 (Debian)
PHP version (eg, 7.4): PHP 8.0.10

The issue you are facing:
Looking at Nextcloud logfile, I frequently find errors from Clamav, indicating “unable to connect to /var/run/clamav/clamd.sock”. This file is actually missing although I’ve (re)created it many times (with proper owner and permissions obviously). It seems some process would delete the socket but I can’t identify which process and when.

Is this the first time you’ve seen this error? N

Steps to replicate it:

  1. Install clamv antivirus

The output of your Nextcloud log in Admin > Logging:

[extract]

{"reqId":"CAfA5mEWiYS5gjiTwYms","level":3,"time":"2022-03-25T09:10:11+00:00","remoteAddr":"255.255.255.255","user":"username","app":"PHP","method":"PUT","url":"/apps/text/session/create","message":"stream_socket_client(): Unable to connect to unix:///var/run/clamav/clamd.sock (No such file or directory) at /var/www/html/custom_apps/files_antivirus/lib/Scanner/ExternalClam.php#41","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0","version":"22.1.1.2","exception":{"Exception":"Error","Message":"stream_socket_client(): Unable to connect to unix:///var/run/clamav/clamd.sock (No such file or directory) at /var/www/html/custom_apps/files_antivirus/lib/Scanner/ExternalClam.php#41","Code":0,"Trace":[{"function":"onError","class":"OC\\Log\\ErrorHandler","type":"::","args":[2,"stream_socket_client(): Unable to connect to unix:///var/run/clamav/clamd.sock (No such file or directory)","/var/www/html/custom_apps/files_antivirus/lib/Scanner/ExternalClam.php",41]},{"file":"/var/www/html/custom_apps/files_antivirus/lib/Scanner/ExternalClam.php","line":41,"function":"stream_socket_client","args":["unix:///var/run/clamav/clamd.sock",0,"",5]},{"file":"/var/www/html/custom_apps/files_antivirus/lib/AvirWrapper.php","line":108,"function":"initScanner","class":"OCA\\Files_Antivirus\\Scanner\\ExternalClam","type":"->","args":[]},{"file":"/var/www/html/custom_apps/files_antivirus/lib/AvirWrapper.php","line":85,"function":"wrapSteam","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869",null]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":301,"function":"fopen","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php","line":236,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/custom_apps/ransomware_protection/lib/StorageWrapper.php","line":317,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/lib/private/Files/View.php","line":682,"function":"fopen","class":"OCA\\RansomwareProtection\\StorageWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/lib/private/Files/Node/Folder.php","line":198,"function":"file_put_contents","class":"OC\\Files\\View","type":"->","args":["/appdata_oc7hmh3uqrlj/text/documents/90869",null]},{"file":"/var/www/html/lib/private/Files/SimpleFS/NewSimpleFile.php","line":133,"function":"newFile","class":"OC\\Files\\Node\\Folder","type":"->","args":["90869",null]},{"file":"/var/www/html/apps/text/lib/Service/DocumentService.php","line":164,"function":"putContent","class":"OC\\Files\\SimpleFS\\NewSimpleFile","type":"->","args":[null]},{"file":"/var/www/html/apps/text/lib/Service/ApiService.php","line":96,"function":"createDocument","class":"OCA\\Text\\Service\\DocumentService","type":"->","args":[{"__class__":"OC\\Files\\Node\\File"}]},{"file":"/var/www/html/apps/text/lib/Controller/SessionController.php","line":50,"function":"create","class":"OCA\\Text\\Service\\ApiService","type":"->","args":[90869,null,null,null,false]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":217,"function":"create","class":"OCA\\Text\\Controller\\SessionController","type":"->","args":[90869,null,false]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":126,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Text\\Controller\\SessionController"},"create"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":156,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Text\\Controller\\SessionController"},"create"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":301,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Text\\Controller\\SessionController","create",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"_route":"text.Session.create"}]},{"file":"/var/www/html/lib/base.php","line":1000,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/text/session/create"]},{"file":"/var/www/html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/lib/private/Log/ErrorHandler.php","Line":92,"CustomMessage":"--"}}
{"reqId":"CAfA5mEWiYS5gjiTwYms","level":3,"time":"2022-03-25T09:10:11+00:00","remoteAddr":"255.255.255.255","user":"username","app":"files_antivirus","method":"PUT","url":"/apps/text/session/create","message":"Cannot connect to \"/var/run/clamav/clamd.sock\": No such file or directory (code 2)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0","version":"22.1.1.2","exception":{"Exception":"RuntimeException","Message":"Cannot connect to \"/var/run/clamav/clamd.sock\": No such file or directory (code 2)","Code":0,"Trace":[{"file":"/var/www/html/custom_apps/files_antivirus/lib/AvirWrapper.php","line":108,"function":"initScanner","class":"OCA\\Files_Antivirus\\Scanner\\ExternalClam","type":"->","args":[]},{"file":"/var/www/html/custom_apps/files_antivirus/lib/AvirWrapper.php","line":85,"function":"wrapSteam","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869",null]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":301,"function":"fopen","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php","line":236,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/custom_apps/ransomware_protection/lib/StorageWrapper.php","line":317,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/lib/private/Files/View.php","line":682,"function":"fopen","class":"OCA\\RansomwareProtection\\StorageWrapper","type":"->","args":["appdata_oc7hmh3uqrlj/text/documents/90869","w"]},{"file":"/var/www/html/lib/private/Files/Node/Folder.php","line":198,"function":"file_put_contents","class":"OC\\Files\\View","type":"->","args":["/appdata_oc7hmh3uqrlj/text/documents/90869",null]},{"file":"/var/www/html/lib/private/Files/SimpleFS/NewSimpleFile.php","line":133,"function":"newFile","class":"OC\\Files\\Node\\Folder","type":"->","args":["90869",null]},{"file":"/var/www/html/apps/text/lib/Service/DocumentService.php","line":164,"function":"putContent","class":"OC\\Files\\SimpleFS\\NewSimpleFile","type":"->","args":[null]},{"file":"/var/www/html/apps/text/lib/Service/ApiService.php","line":96,"function":"createDocument","class":"OCA\\Text\\Service\\DocumentService","type":"->","args":[{"__class__":"OC\\Files\\Node\\File"}]},{"file":"/var/www/html/apps/text/lib/Controller/SessionController.php","line":50,"function":"create","class":"OCA\\Text\\Service\\ApiService","type":"->","args":[90869,null,null,null,false]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":217,"function":"create","class":"OCA\\Text\\Controller\\SessionController","type":"->","args":[90869,null,false]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":126,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Text\\Controller\\SessionController"},"create"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":156,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Text\\Controller\\SessionController"},"create"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":301,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Text\\Controller\\SessionController","create",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"_route":"text.Session.create"}]},{"file":"/var/www/html/lib/base.php","line":1000,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/text/session/create"]},{"file":"/var/www/html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/custom_apps/files_antivirus/lib/Scanner/ExternalClam.php","Line":43,"CustomMessage":"--"}}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/__groupfolders/13/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/freetype6.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/__groupfolders/13/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/zlib1.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/freetype6.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/zlib1.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/freetype6.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}
{"reqId":"bP3AewN1pVSxrian7ohL","level":2,"time":"2022-03-25T09:11:37+00:00","remoteAddr":"255.255.255.255","user":"username","app":"ransomware_protection","method":"PROPFIND","url":"/remote.php/dav/files/username/Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils","message":"Prevented upload of Secretariat/10_tools/backup05mar18/PHPExcel/Shared/PDF/fonts/utils/zlib1.dll because it matches extension pattern \".dll\"","userAgent":"Mozilla/5.0 (Macintosh) mirall/3.3.6git (build 7956) (Nextcloud, osx-20.3.0 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"22.1.1.2"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'default_phone_region' => 'BE',
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'instanceid' => 'instanceid',
  'passwordsalt' => 'passwordsalt',
  'secret' => 'secret',
  'trusted_domains' => 
  array (
    0 => 'nc.mydomain.com',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '22.1.1.2',
  'overwrite.cli.url' => 'https://nc.mydomain.com',
  'overwriteprotocol' => 'https',
  'dbname' => 'nextcloud',
  'dbhost' => 'mariadb',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'dbuser',
  'dbpassword' => 'dbpwd',
  'installed' => true,
  'mail_from_address' => 'nextcloud',
  'mail_smtpmode' => 'smtp',
  'mail_sendmailmode' => 'smtp',
  'mail_domain' => 'mydomain.com',
  'mail_smtpsecure' => 'ssl',
  'mail_smtpauthtype' => 'LOGIN',
  'mail_smtpauth' => 1,
  'mail_smtphost' => 'smtp.host',
  'mail_smtpport' => '465',
  'mail_smtpname' => 'nextcloud@mydomain.com',
  'mail_smtppassword' => 'mailsmtppwd',
  'allow_local_remote_servers' => true,
  'app_install_overwrite' => 
  array (
    0 => 'groupfolders',
  ),
  'maintenance' => false,
  'log_rotate_size' => 5242880,
  'loglevel' => 2,
  'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
);

The output of your Apache/nginx/system log in /var/log/____:

[empty]

As of “[SOLVED] clamd.sock: connect: Permission denied / Networking, Server, and Protection / Arch Linux Forums” i needed to set the appropriate path to the socket file in the “clamav-daemon.socket”-file. Actually no more issues. Hopefully this sustains.