Each time freshclam runs automatically via clamd it is leaving 2 temporary files in /tmp.

-rw-------   1 root   root         0 Sep 29 09:17 tmp.UdjG3Qnk4E
-rw-------   1 root   root         0 Sep 29 09:17 tmp.ckxjwHlr6w
-rw-------   1 root   root         0 Sep 29 10:06 tmp.NH7Q23MtU2
-rw-------   1 root   root         0 Sep 29 10:06 tmp.mZHPFuqY8n
srw-rw-rw-   1 root   root         0 Sep 29 11:00 clamd.socket
-rw-------   1 root   root         0 Sep 29 11:11 tmp.PTl4mGJ2uG
-rw-------   1 root   root         0 Sep 29 11:11 tmp.KDrXkCQfvd
-rw-r-----   1 clamav clamav     377 Sep 29 11:11 ClamAV.update.log

No errors are recorded in the log file or in maillog or messages.

clamd -V
ClamAV 0.103.0/25941/Mon Sep 28 13:55:11 2020

freshclam
ClamAV update process started at Tue Sep 29 11:15:28 2020
daily.cld database is up to date (version: 25941, sigs: 4323511, f-level: 63, builder: raynman)
main.cld database is up to date (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
bytecode.cld database is up to date (version: 331, sigs: 94, f-level: 63, builder: anvilleg)

Running with standard (sample) conf files

It also happened under 0.98.4. I have a 2nd mail server which is working fine.

I guess it is because the tmp files are owned by root for some reason rather than clamav

Thanks for any help