I forgot to mention that the above solution works within our LXC guest environments, but it is not sufficient when running on physical hardware.
It seems, that the clamav startup scripts are executed a bit too early. When they are started, the folder /run or /var/run is not yet a tmpfs. So the PID files will be written to the harddisk instead of the tmpfs. When the system is now putting the tmpfs over /run the PIDs are virtually gone and the monitoring service is unable to see them. The systemd scripts clamav-daemon.service and clamav-freshclam.service both require clamav-daemon.socket, so it is necessary to postpone the execution of it a little bit. I have added the following line to /lib/systemd/system/clamav-daemon.socket: After=network.target Honestly I don't know which service is the best one to wait for here. I just chose network.target, because I knew it is going to be late enough. Maybe someone has a better idea here. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1624262 Title: clamav unable to create pid file using systemd To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1624262/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs