1

I created a ClamAV on-access scanning systemd service, to be permanent so that I can enable, start and then leave it, without having to touch it again.

I can manually start the service, and it works fine. But it keeps failing to start automatically after login as expected. In both cases, there are no active network connections.

I believe the following journal output (found in last ouput section of the post) could be a clue:

rc.local[1188]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
rc.local[1188]: ERROR: Clamonacc: daemon is local, but a connection could not be established

But I still don't why I'm able to manually start the service, but not have it start automatically.

System info

$ uname -a

Linux debian 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU/Linux

rc-local.service file

$ sudo cat /etc/systemd/system/rc-local.service

[Unit]
Description=ClamAV On-Access Scanner
ConditionPathExists=/etc/rc.local

[Service]
Type=forking
User=root
Require=network.target
RemainAfterExit=yes
ExecStart=/etc/rc.local start
TimeoutSec=200
Restart=on-failure
StartLimitInterval=10

[Install]
WantedBy=multi-user.target

rc.local script

$ sudo cat /etc/rc.local

#!/bin/sh -e

/usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log

exit 0

Status after logging in

● rc-local.service - ClamAV On-Access Scanner
   Loaded: loaded (/etc/systemd/system/rc-local.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/rc-local.service.d
           └─debian.conf
   Active: failed (Result: exit-code) since Wed 2020-10-21 08:06:33 BST; 12min ago
  Process: 1483 ExecStart=/etc/rc.local start (code=exited, status=2)

Oct 21 08:06:33 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 08:06:33 debian systemd[1]: Stopped ClamAV On-Access Scanner.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:33 debian systemd[1]: Failed to start ClamAV On-Access Scanner.

Status after manually starting service

● rc-local.service - ClamAV On-Access Scanner
   Loaded: loaded (/etc/systemd/system/rc-local.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/rc-local.service.d
           └─debian.conf
   Active: active (running) since Wed 2020-10-21 08:23:04 BST; 52s ago
  Process: 7171 ExecStart=/etc/rc.local start (code=exited, status=0/SUCCESS)
 Main PID: 7173 (clamonacc)
    Tasks: 8 (limit: 4915)
   Memory: 2.6M
   CGroup: /system.slice/rc-local.service
           └─7173 /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log

Oct 21 08:23:04 debian systemd[1]: Starting ClamAV On-Access Scanner...
Oct 21 08:23:04 debian systemd[1]: Started ClamAV On-Access Scanner.

Journal

$ sudo journalctl | grep rc-local

Oct 21 08:06:22 debian systemd[1]: /etc/systemd/system/rc-local.service:7: Unknown lvalue 'Require' in section 'Service', ignoring
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 1.
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:31 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 2.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 3.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 4.
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 08:06:32 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 08:06:33 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.

$ sudo journalctl | grep rc.local

Oct 21 13:47:57 debian rc.local[1097]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:57 debian rc.local[1097]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 1.
Oct 21 13:47:57 debian rc.local[1188]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:57 debian rc.local[1188]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:57 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 2.
Oct 21 13:47:58 debian rc.local[1361]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1361]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 3.
Oct 21 13:47:58 debian rc.local[1372]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1372]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 4.
Oct 21 13:47:58 debian rc.local[1374]: ERROR: ClamClient: could not connect to remote clam daemon, Couldn't connect to server
Oct 21 13:47:58 debian rc.local[1374]: ERROR: Clamonacc: daemon is local, but a connection could not be established
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
Oct 21 13:47:58 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Service RestartSec=100ms expired, scheduling restart.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Scheduled restart job, restart counter is at 5.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Start request repeated too quickly.
Oct 21 13:47:59 debian systemd[1]: rc-local.service: Failed with result 'exit-code'.
Oct 21 13:48:14 debian sudo[2222]:   squire : TTY=pts/0 ; PWD=/home/squire ; USER=root ; COMMAND=/usr/sbin/service rc-local status
Oct 21 13:54:30 debian sudo[16421]:   squire : TTY=pts/1 ; PWD=/home/squire ; USER=root ; COMMAND=/usr/sbin/service rc-local status
Improve this question
1
  • You can reset a failed unit (Start request repeated too quickly) with the command systemctl reset-failed <UNIT_NAME> to be able to start over. But you'll need to resolve the other errors leading to the failed unit in the first place.
    – eblock
    Oct 21, 2020 at 14:06

1 Answer 1

Reset to default
0

After a lot of trial and error, trying various options discovered during my research, I've found a combination that works as expected.

I believe the causes of the previous failures were the absence of:

After=clamav-daemon.service syslog.target network-online.target
Requires=clamav-daemon.service

and

Type=simple

rc-local.service file

[Unit]
Description=ClamAV On-Access Scanner
After=clamav-daemon.service syslog.target network-online.target
Requires=clamav-daemon.service

[Service]
Type=simple
User=root
RemainAfterExit=yes
ExecStart=/etc/rc.local start
Restart=on-failure
RestartSec=10s

[Install]
WantedBy=multi-user.target

I did notice that after one successful start, on a second test it failed. I realised this was due to an exit code of 1 due to attempting to mkdir /tmp/clamonacc-quarantine, which was still present because of the previous test carried out in the same session. I've added comments to clarify/explain my changes.

rc.local script

#!/bin/sh -e

dir=clamonacc-quarantine

# Check if the folder for quarantining already exist. If it does, go straight to the main process
if $(/bin/ls /tmp/$dir)
then
    # Run the main process, start logging and move any infected files to the quarantine folder
    /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/$dir/
else
    /bin/mkdir /tmp/$dir
    /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/$dir/
fi

exit 0

Process active

$ ps -aux | grep clamonacc

root      2514  0.0  0.0 213552  5064 ?        Ssl  17:21   0:00 /usr/bin/clamonacc --log=/var/log/clamav/clamonacc.log --move=/tmp/clamonacc-quarantine/
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .