[clamav-users] Use of clamav-daemon.socket? (0.102.0)

[Frans de Boer]

On 09-11-2019 14:39, Markus Kolb wrote:
> Am 09.11.2019 10:46, schrieb Frans de Boer:
>> LS,
>>
>> I use several machines and found that most of the time the use of the
>> 'clamav-daemon.socket' file only leads to a startup failure of clamd.
>> Why is this file file in the first place? I ask this because clamd is
>> already creating the socket - that is, when the socket was not created
>> earlier.
>>
>> In my current configurations, I just disabled the
>> clamav-clamonacc.socket file without problem.
>>
>> So, what is it's intended use?
>>
>> --- Frans.
>
> Hi Frans,
>
> the socket file is used for local communication with clamd. So 
> clamdscan can give scanjobs to clamd.
> Also clamdtop can get info from clamd.
>
> It is also possible to configure a TCP socket for remote (also local) 
> communication.
>
> I don't know why you have 2 different sockets... 
> clamav-daemon.socket/clamav-clamonacc.socket?!
>
> Do you use different config files for clamonacc and clamd?
> Both should use the same socket. Clamonacc gives the jobs to clamd and 
> so needs the socket of clamd.
>
> There is also an option FixStaleSocket which should handle your 
> startup problems.
> But this is per default enabled and so might be disabled in your config.
>
> If you run multiple clamd on one system each need to have a different 
> socket filename.
>
> cu
> Markus

I have a) clamav-daemon.service and b) clamav-daemon-socket (NOT 
clamav-clamonacc.socket - sorry my mistake). c) would than be 
clamav-clamonacc.service which uses the clamd.ctl socket to communicate 
with clamd.

b) does start faster then a) which causes a) to fail - regardless the 
implicit/explicit setting of the FixStaleSocket.

Removing b) from the a) service file is the only solution and avoids the 
circular dependencies when using After= and/or Before= as well as Wants= 
instead of Requires= directives.

Why making b) available in the first place? The socket is anyhow created 
by clamd, and the b) file is only useful if there is some action 
specified and the output is either another socket, other file or journal 
output.

And no, I use one instance of clamd per system. Using the TCP socket 
does not speed things up either ;). The latter is useful in 
multiple-clients single-scan engine.

--- Frans