clamav "killed" with no explanation
On a Debian 10 server I have this problem with clamav:
root@vps:~# clamscan -r -v --stdout /
Killed
You see I use the verbose flag but that does not give me any information. In years of using clam I have not had this problem. I know it's not a database problem:
root@vps:~# freshclam
Sun Mar 1 00:18:39 2020 -> ClamAV update process started at Sun Mar 1 00:18:39 2020
Sun Mar 1 00:18:39 2020 -> daily.cvd database is up to date (version: 25737, sigs: 2201376, f-level: 63, builder: raynman)
Sun Mar 1 00:18:39 2020 -> main.cvd database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
Sun Mar 1 00:18:39 2020 -> bytecode.cvd database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)
Please suggest steps to test.
EDIT: This is an OpenVZ VPS with 512MB RAM.
EDIT: strace
shows killed by SIGKILL
but that doesn't tell me much.
As mentioned in some of the other comments, the likely culprit is oom_killer
or oom_reaper
. You can check for this by tailing /var/log/messages
while running clamscan
. Ex:
# Kick this off in a console and keep an eye on it
sudo tail -f /var/log/messages
# Run this in a separate console
sudo clamscan /etc/
In my case, clamscan
died after a few seconds, and messages such as the following appeared within /var/log/messages
:
kernel: oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-1000.slice/session-1.scope,task=clamscan,pid=1520,uid=0
kernel: Out of memory: Killed process 1520 (clamscan) total-vm:836952kB, anon-rss:540640kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:1248kB oom_score_adj:0
kernel: oom_reaper: reaped process 1520 (clamscan), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
So, if you observe the same thing, then you should try allocating more resources (ie: memory) to the machine instance.