ClamAV Error

Hello. I’m still very new to TrueNAS and I like working with it so far. I have a brand new installation using TrueNAS version 25.04.1. I installed the ClamAV app with no issues. I couldn’t find a guide on how to configure ClamAV with TrueNAS but I followed this page:

I had already configured TrueNAS to send me error emails and I received my first ClamAV error message email from TrueNAS. The email stated:

ERROR: Problem with internal logger.
ERROR: Can’t open /mnt/logs/clamav-scan-06-29-2025_00-00.log in append mode (check permissions!).

In the logs, I also found this message but am unclear as to what this is referencing:

2025-06-28 17:28:39.854156+00:00Socket for clamd not found yet, retrying (1/1800) …
Socket for clamd not found yet, retrying (2/1800) …
Socket for clamd not found yet, retrying (3/1800) …
Socket for clamd not found yet, retrying (4/1800) …
Socket for clamd not found yet, retrying (5/1800) …
Socket for clamd not found yet, retrying (6/1800) …
Socket for clamd not found yet, retrying (7/1800) …
Socket for clamd not found yet, retrying (8/1800) …
Socket for clamd not found yet, retrying (9/1800) …
Socket for clamd not found yet, retrying (10/1800) …Sat Jun 28 17:28:39 2025 → Limits: Global time limit set to 120000 milliseconds.

Anyone have any ideas on what may be occurring? Is there a better document or page explaining configuring ClamAV with TrueNAS? Any thoughts at all?

Did you check permissions on /mnt/logs/clamav-scan-06-29-2025_00-00.log ? Did they go read-only? Though I don’t know why that would happen, I’m afraid.

@Miles Is there a way to delete ClamAV and then re-install to start the configuration all over from scratch?

@Miles I don’t think you need execute permissions here; you are not running logs as scripts; you are just appending and creating them. - but you might add write permissions for the group. I don’t know how to delete and reinstall ClamAV inside TrueNAS.

@Miles I stopped the ClamAV process and deleted the app with no issues. I re-installed and went through the setup steps once again and set my CRON job. ClamAV now works.

Unfortunately, it looks like ClamAV runs on a single core. I’ve got a monster CPU in this build and have plenty of cores to play with. I’ve set ClamAV to use 8 CPUs and 32 Gig or RAM in the ClamAV app. Any ideas on a command line switch I could use to cause ClamAV to use multiple cores? This would be most helpful. Thanks.

Start with the ClamAV docs. It may be single threaded.
https://www.clamav.net/

@SmallBarky Thanks for the reply. So everything I’ve read suggests that clamscan is single threaded.

ClamAV finally finished its first scan and I received a couple of error messages -

Example:
LibClamAV Warning: PNG: Unexpected early end-of-file.
A little searching around found that ClamAV encountered a PNG file that is either not a valid PNG file or is corrupted, possibly truncated. I’ve certainly received an effton of these lines in the log. Interestingly, why doesn’t ClamAV give me the path/file name so I can investigate? Is there a command line switch to tell me this? If not…

Example:
LibClamAV Warning: file_bytes is not valid unicode: invalid utf-8 sequence of 1 bytes from index 2615
Some searching on this describes ClamAV encountered an invalid UTF-8 sequence while processing a file. This typically happens when the file contains non-UTF-8 encoded data, such as binary content or text encoded in a different format. If ClamAV only gave me the path/file name to investigate. Is there a command line switch to tell me? If not…

Example:
LibClamAV Warning: utf16 length is not multiple of two: 91
Some searching suggests that the file contains UTF-16 encoded text where the length of the text is not a multiple of two, which is invalid for UTF-16 encoding. Same thing, if ClamAV only gave me the path/file name to investigate. Is there a command line switch to tell me? If not…

Example:
LibClamAV Warning: cli_scangpt: detected a non-protective MBR
Some searching suggests this could be a false positive.

Example:
LibClamAV Warning: cli_msxml_parse_document: encountered issue in parsing xml document
Same thing, if ClamAV only gave me the path/file name to investigate. Is there a command line switch to tell me? If not…

Example:
LibClamAV Warning: SWF: declared output length != inflated stream size, 2172086 != 2114574
Same thing, if ClamAV only gave me the path/file name to investigate. Is there a command line switch to tell me? If not…

I added a --debug switch to the TrueNAS ClamAV command line to see what happens.

Any other ideas on finding the offending files? Thanks.

I would try a forum for ClamAV.

1 Like

@SmallBarky I actually already looked for a forum specific to ClamAV and no joy, at least with my searches. Other applications that use ClamAV discuss it in their forums but I don’t see a forum specific to ClamAV. :thinking: