Solved Clamav causing daily log floods with File path check failure on new server

[Richard G]

We installed a new server this week with clamav on it too (no uploadscan) and Maldetect.

Now in the logfiles we get a log file flooding like this:

Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/srp_me.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure for: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/at.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/at.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure for: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/de_li.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/de_li.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure for: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/pt_pt.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/pt_pt.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure for: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/hu.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/hu.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure for: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/mk.gif
Mar 14 03:09:26 server29 clamd[1464]: File path check failure on: /home/customer/domains/customerdomain.nl/public_html/web/media/mod_languages/images/mk.gif

I can't find any "no permission" warnings, only the above.
Also checked the directory and the files do exist. For example:

-rw-r--r-- 1 customer customer  402 2025-03-04 20:13 mk.gif
-rw-r--r-- 1 customer customer  402 2025-03-04 20:13 mk_mk.gif

It's not only this customer, it's various customers when the check is done, causing log file floodings every night.

So since these files are present and reachable, what is causing this and how can I fix this?

 

[Richard G]

Found it.

Had to set "user root" in camd's scan.conf so wondering why this is not done by default when installing.

 

[zEitEr]

ClamAV gets installed from an OS repository. DirectAdmin would need to fix the config file in such a case. Probably Directadmin developers are not aware of the issue, or have their own thoughts on the matter.

 

[Richard G]

ClamAV gets installed from an OS repository.

Ah yes indeed, that changed a couple of years ago.
I forgot that because normally I rsync the scan.conf and freshclam.conf from another server and then I don't encounter the problem. Probably forgotten this time. I'm getting old, LoL.
But well... fore sure somebody else will benefit from the solution on fresh installation some time in the future.