1

I created a ClamAV on-access scanning systemd service, to be permanent so that I can enable, start and then leave it, without having to touch it again.

I can manually start the service, and it works fine. But it keeps failing to start automatically after login as expected. In both cases, there are no active network connections.

I believe the following journal output (found in last ouput section of the post) could be a clue:

rc.local[1188]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
rc.local[1188]: ERROR: Clamonacc: daemon is local, but a connection could not be established

But I still don't why I'm able to manually start the service, but not have it start automatically.

System info

$ uname -a

Linux debian 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU/Linux

rc-local.service file

$ sudo cat /etc/systemd/system/rc-local.service

[Unit]
Description=ClamAV On-Access Scanner
ConditionPathExists=/etc/rc.local

[Service]
Type=forking
User=root
Require=network.target
RemainAfterExit=yes
ExecStart=/etc/rc.local start
TimeoutSec=200
Restart=on-failure
StartLimitInterval=10

[Install]
WantedBy=multi-user.target

rc.local script

$ sudo cat /etc/rc.local

#!/bin/sh -e

/usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log

exit 0

Status after logging in

● rc-local.service - ClamAV On-Access Scanner
   Loaded: loaded (/etc/systemd/system/rc-local.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/rc-local.service.d
           └─debian.conf
   Active: failed (Result: exit-code) since Wed 2020-10-21 08:06:33 BST; 12min ago
  Process: 1483 ExecStart=/etc/rc.local start (code=exited, status=2)

Oct 21 08:06:33 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 08:06:33 debian systemd[1]: Stopped ClamAV On-Access Scanner.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:33 debian systemd[1]: Failed to start ClamAV On-Access Scanner.

Status after manually starting service

● rc-local.service - ClamAV On-Access Scanner
   Loaded: loaded (/etc/systemd/system/rc-local.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/rc-local.service.d
           └─debian.conf
   Active: active (running) since Wed 2020-10-21 08:23:04 BST; 52s ago
  Process: 7171 ExecStart=/etc/rc.local start (code=exited, status=0/SUCCESS)
 Main PID: 7173 (clamonacc)
    Tasks: 8 (limit: 4915)
   Memory: 2.6M
   CGroup: /system.slice/rc-local.service
           └─7173 /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log

Oct 21 08:23:04 debian systemd[1]: Starting ClamAV On-Access Scanner...
Oct 21 08:23:04 debian systemd[1]: Started ClamAV On-Access Scanner.

Journal

$ sudo journalctl | grep rc-local

Oct 21 08:06:22 debian systemd[1]: /etc/systemd/system/rc-local.service:7: Unknown lvalue 'Require' in section 'Service', ignoring
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 1.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 2.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 3.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 4.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
$ sudo journalctl | grep rc.local

Oct 21 13:47:57 debian rc.local[1097]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:57 debian rc.local[1097]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 1.
Oct 21 13:47:57 debian rc.local[1188]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:57 debian rc.local[1188]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 2.
Oct 21 13:47:58 debian rc.local[1361]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1361]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 3.
Oct 21 13:47:58 debian rc.local[1372]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1372]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 4.
Oct 21 13:47:58 debian rc.local[1374]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1374]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:48:14 debian sudo[2222]:   squire : TTY=pts/0 ; PWD=/home/squire ; USER=root ; COMMAND=/usr/sbin/service rc-local status
Oct 21 13:54:30 debian sudo[16421]:   squire : TTY=pts/1 ; PWD=/home/squire ; USER=root ; COMMAND=/usr/sbin/service rc-local status
1
  • You can reset a failed unit (Start request repeated too quickly) with the command systemctl reset-failed <UNIT_NAME> to be able to start over. But you'll need to resolve the other errors leading to the failed unit in the first place.
    – eblock
    Oct 21, 2020 at 14:06

1 Answer 1

0

After a lot of trial and error, trying various options discovered during my research, I've found a combination that works as expected.

I believe the causes of the previous failures were the absence of:

After=clamav-daemon.service syslog.target network-online.target
Requires=clamav-daemon.service

and

Type=simple

rc-local.service file

[Unit]
Description=ClamAV On-Access Scanner
After=clamav-daemon.service syslog.target network-online.target
Requires=clamav-daemon.service

[Service]
Type=simple
User=root
RemainAfterExit=yes
ExecStart=/etc/rc.local start
Restart=on-failure
RestartSec=10s

[Install]
WantedBy=multi-user.target

I did notice that after one successful start, on a second test it failed. I realised this was due to an exit code of 1 due to attempting to mkdir /tmp/clamonacc-quarantine, which was still present because of the previous test carried out in the same session. I've added comments to clarify/explain my changes.

rc.local script

#!/bin/sh -e

dir=clamonacc-quarantine

# Check if the folder for quarantining already exist. If it does, go straight to the main process
if $(/bin/ls /tmp/$dir)
then
    # Run the main process, start logging and move any infected files to the quarantine folder
    /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/$dir/
else
    /bin/mkdir /tmp/$dir
    /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/$dir/
fi

exit 0

Process active

$ ps -aux | grep clamonacc

root      2514  0.0  0.0 213552  5064 ?        Ssl  17:21   0:00 /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/clamonacc-quarantine/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.