Issue with CLAMAV

ℹ️ Support
, ,
1
Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart:

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
  • Operating system and version (e.g., Ubuntu 24.04):
    • Ubuntu 22.04.5 LTS Linux 5.15.0-151-generic x86_64
  • Web server and version (e.g, Apache 2.4.25):
    • replace me
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • replace me
  • PHP version (e.g, 8.3):
    • replace me
  • Is this the first time you’ve seen this error? (Yes / No):
    • replace me
  • When did this problem seem to first start?
    • replace me
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • replace me
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • replace me

Summary of the issue you are facing:

Suddenly, NC cannot connect to ClamAV ; so users cannot upload files on the server

Steps to replicate it (hint: details matter!):

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

 RuntimeException Could not connect to ClamAV via 127.0.0.1:3310. Please check that ClamAV is running and reachable.

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

PASTE

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

PASTE HERE

Apps

The output of occ app:list (if possible).

Tips for increasing the likelihood of a response

  • Use the preformatted text formatting option in the editor for all log entries and configuration output.
  • If screenshots are useful, feel free to include them.
    • If possible, also include key error output in text form so it can be searched for.
  • Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.
2

Hey @EGU973002022 welcome back and thanks for supporting the snap :waving_hand:

can you please be clear what you mean when you say Nextcloud cannot connect to ClamAV?

  • since when is suddenly?
  • what changes took place since this issue has appeared?
  • is ClamAV a service hosted on a separate host?

we’ll definitely need logs to get to the bottom of this. so please run the debugging script or check out How to manage Nextcloud snap logs to find and get those logs.

3

I do not understand how, but ClamAV is not anymore listening on port 3310

$ netstat -lnp | grep -E “(clam|3310)”
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
unix 2 [ ACC ] STREAM LISTENING 22107 - /run/clamav/clamd.ctl

Although, it was well working in the past…

For this configuration, I added port in freshclam.conf

sudo vi /etc/clamav/freshclam.conf

…

TCPSocket 3310

I noticed my config was removed from freshclam.conf (maybe due to an update ?) and now even by added again TPCSocket 3310 in freshclam.conf, it does'nt work. ClamAV is not listening on port 3310.

I would like to add that my NC instance is a SNAP version under Ubuntu with activated updates.
But ClamAV is a systemd service installed on my local Ubuntu.

So I do not know how to restore communication between them.

May you Help me ?

Best Regards

4

since when is suddenly?

Since this week end, when user reported the issue

what changes took place since this issue has appeared?
I did not see change, or maybe an package update ?

is ClamAV a service hosted on a separate host?

ClamAV is a systemd Service on my local Ubuntu, but my NC is a Snap version installed on my local Ubuntu

5

@EGU973002022 this makes me wonder, has it ever worked?

If ClamAV is present on the same host and you’re trying to execute any binaries that are not contained in the snap, this will fail due to snap confinement.

then you’d be better off asking the ClamAV folks.

6

OK, I understand that. But now how can I desactivate ClamAV in NC, temporary in order to restore the file upload for users ?
I kwow that it is not secure, but the risk is our appreciation.

7

show your app list

sudo nextcloud.occ app:list

to disable an app without removing it:

sudo nextcloud.occ app:disable <appname>

see

8

Thank you so much :folded_hands:

1 Like
9

That ClamAV stops working “suddenly”, is correct.
freshclam updates malware signatures frequently, but ClamAV itself also needs updates from time to time.

If ClamAV is outdated, it writes log entries into the logs of programs using ClamAV at every startup of the clamd service. After 1 or 2 months ClamAV stops working. Then you will get the error message that it refuses to connect to TPCSocket 3310.

ClamAV needs to be updated from the source you installed it resp. your Linux or download, compile, install and configure a tar-ball from clamav.net.

In the future I recommend a weekly check of the log-files, whether ClamAV is outdated. Starting then, you will have 1 month minimum to update the ClamAV-package.

1 Like
10

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.