> Every few weeks I'll start seeing this error:
>
> ERROR: clam database directory (clam_dbs) not writable /var/lib/clamav
>
> Running this fixes it:
> su clamav -s '/usr/local/sbin/clamav-unofficial-sigs.sh'
>
> Here are the files not owned by clamav:
> -rw-r--r--  1 clamupdate clamupdate    296388 Sep 19  2019 bytecode.cvd
> -rw-r--r--  1 clamupdate clamupdate 112832258 Sep 17 09:53 daily.cvd
> -rw-r--r--  1 clamupdate clamupdate 117859675 Nov 25  2019 main.cvd
>
At first glance it appears someone is running "freshclam" manually as
clamupdate/clamupdate.

Is there only one "freshclam" binary on the system?

ls -l /usr/bin/freshclam*

Is it running as a daemon or being invoked by some other method(s)?

systemctl status clamav-freshclam.service
● clamav-freshclam.service - ClamAV virus database updater
     Loaded: loaded (/usr/lib/systemd/system/clamav-freshclam.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2020-10-09 04:46:04 EDT; 6h ago
       Docs: man:freshclam(1)
             man:freshclam.conf(5)
             https://www.clamav.net/documents
   Main PID: 937912 (freshclam)
      Tasks: 1 (limit: 154197)
     Memory: 337.2M
     CGroup: /system.slice/clamav-freshclam.service
             └─937912 /usr/bin/freshclam -d --foreground=true

systemctl status clam-freshclam.service
● clam-freshclam.service - freshclam scanner
     Loaded: loaded (/usr/lib/systemd/system/clam-freshclam.service; disabled; vendor preset: disabled)
     Active: inactive (dead)

Is there another that is set{g,u}id clamupdate?

Oh, what binaries *are* set{g,u}id clamupdate?

And who/what regularly uses the "clamupdate" id?