If I comment out the UpdateLogFile line from /etc/clamav/freshclam.conf like so...

\#UpdateLogFile /var/log/clamav/freshclam.log

...then I am able to run sudo freshclam no problem:

/etc/clamav$ sudo freshclam ClamAV update process started at Mon Feb 
6 00:17:07 2017 main.cvd is up to date (version: 57, sigs: 4218790,
f-level: 60, builder: amishhammer) daily.cld is up to date (version:
23009, sigs: 1509149, f-level: 63, builder: neo) bytecode.cld is up to
date (version: 290, sigs: 55, f-level: 63, builder: neo)

However, if I uncomment the UpdateLogFile line in freshclam.conf and run sudo freshclam, I get this:

/etc/clamav$ sudo freshclam 
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

Here are the permissions on /var/log:

drwxrwxrwx  1 root root     9 Feb  3  2016 log

Here are the permissions on /var/log/clamav:

drwxr-xr-x  2 clamav    clamav    4096 Feb  5 22:18 clamav

And here are the permissions on /var/log/clamav/freshclam.log:

-rw-r-----  1 clamav adm       0 Feb  5 22:18 freshclam.log

I spent all day trying solutions mentioned in various forums with no luck.

Here is the version of Ubuntu server I am running:

Description:    Ubuntu 14.04.5 LTS

And the engine version of clamav:

Engine version: 0.99.2

Could someone help me?

Stopping the clamav-daemon does not help:

/var/log$ sudo /etc/init.d/clamav-daemon stop 

* Stopping ClamAV daemon clamd        
[ OK ]  /var/log$ sudo freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check
permissions!). ERROR: Problem with internal logger (UpdateLogFile =

The output of sudo lsof | grep clam is nothing:

/var/log$ sudo lsof | grep clam

It appears that nothing has a lock on /var/log/clamav/freshclam.log

Here is the output of sudo service --status-all | grep clamav, not including the lines that had question marks and were unrelated to clamav:

$ sudo service --status-all | grep clamav 
[ - ] clamav-daemon
[ - ] clamav-freshclam

Same Can't open /var/log/clamav/freshclam.log in append mode (check permissions!) error when I try to run clamav-daemon:

$ sudo service clamav-daemon start
 * Starting ClamAV daemon clamd
ERROR: Can't open /var/log/clamav/clamav.log in append mode (check permissions!).
ERROR: Can't initialize the internal logger

UPDATE: purging and reinstalling clamav, clamav-freshclam and clamav-daemon did not resolve the issue. I still get the same error:

$ sudo freshclam
ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

UPDATE 2: I did a sudo reboot, stopped clamav-freshclam, made sure sudo lsof | grep clam returned nothing and that the output of sudo service --status-all | grep clamav still only had minus symbols next to clamav and clamav-daemon. Ran sudo freshclam again, and same error as above (again).

  • My clam has the same permission with yours and the only thing I see when I try sudo freshclam is the log file is locked by the clamav daemon so I know clamav is working, this append issue with your is what I trying to understand. Feb 6, 2017 at 5:51
  • Hi George. When I run sudo lsof | grep /var/log/clamav/clamav.log, I do not see a line for /var/log/clamav/clamav.log, no. Regarding clamav-daemon, it appears to be installed based on the output of apt list --installed | grep clamav: clamav-daemon/trusty-updates,trusty-security,now 0.99.2+addedllvm-0ubuntu0.14.04.1 amd64 [installed]
    – IcA
    Feb 6, 2017 at 5:52
  • Please show me the result of cat /etc/passwd | grep clamav Feb 10, 2017 at 5:10
  • Please do four things: 1) Comment out the line in the /etc/clamav/freshclam.conf, 2) restart your system, 3) run sudo tail -f /var/log/clamav/clamav.log, 4) run sudo tail -f /var/log/clamav/freshclam.log Please paste the results Feb 10, 2017 at 5:23
  • Also please post the complete content of the /etc/clamav/freshclam.conf Feb 10, 2017 at 5:30

8 Answers 8


sudo freshclam command is used for updating your antivirus database, which cannot be run while another instance (auto update) is already running.

Stop auto uptade process: sudo /etc/init.d/clamav-freshclam stop

Run manual update: sudo freshclam

Re-Start auto update process: sudo /etc/init.d/clamav-freshclam start


  • Hi Sirajus. Thanks for the response; however, running sudo freshclam is clearly not the problem in and of itself, since I can run sudo freshclam just fine as long as the UpdateLogFile line is commented out in /etc/clamav/freshclam.conf. The problem is with writing to /var/log/clamav/freshclam.log. I assume it's a permissions issue, I'm just not sure what the solution is. Your suggestion did not resolve the issue.
    – IcA
    Feb 6, 2017 at 4:42

I had this issue as well and all that I really needed to do was set permissions on the log file :

chown -R clamav:adm /var/log/clamav/

For me, I couldn't find the /var/log/clamav/ directory so I simply created it:

mkdir /var/log/clamav/

and changed ownership:

chown -R clamav:clamav /var/log/clamav/

And it worked!


I have looked at this article, and at my own clamav installation and would like to profer a solution.

Like you error message shows it's a permission problem and so try these solutions in sequence, I believe one should work:

Option 1

  1. Checking adm group members and adding $USERNAME to it:

     cat /etc/group | grep ^adm
     # Result should be some thing similar to this:
    • where syslog: generates a log message, which will be distributed by syslogd, and george: user or owner of the system
  2. If members of the adm don't include you or syslod add:

     sudo usermod -a -G adm syslog, and or
     sudo usermod -a -G adm $USERNAME 
  3. Restart the system and check if freshclam is working.

Option 2

  1. Change the ownership of these files:

     sudo chgrp $USERNAME /var/log/clamav/freshclam.log
     sudo chgrp $USERNAME /var/log/clamav/clamav.log
  2. Restart our system and check if freshclam is working



I used the command sudo freshclam and it kept timing out. However, I was able to download the main database

The download file is called main.cvd and is 112.4 Mb. There is a 178.4 Mb file in /var/lib/clamav/daily.cld and it is timestamped with today's date.

It seems I'm up to date anyway?


I had the same problem. I just changed the updatelogfile line in freshclam.conf to /var/log/clamav.

The freshclam.conf is located in /usr/local/etc/freshclam.conf


Permissions, permissions!

Sometimes the error message does not always point to the actual cause of the problem. Yes the ownership and permissions on the files and directories need to be correct (viz owned by clamav and writeable by the user clamav) but if you happen to be running apparmor you must also ensure that the apparmor profile usr.bin.freshclam in /etc/apparmor.d contains

          /var/lib/clamav/**     krw,
          /var/log/clamav/**     krw,

(the lib entry is the directory where the clamav database is created, and log entry is for the log files) or you will still get the permission denied message

   Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).

(Similar arrangement apply for those who are using selinux instead of apparmor, but this is unlikely for most Ubuntu users.)


Execute ps -ef | grep clam and you might see that freshclam is already run as a daemon for you so, I guess you don't need to run it manually. But if you really want to run it you can execute: sudo -u clamav freshclam.

$ps -ef | grep clam
clamav   2134306       1  1 10:57 ?        00:00:05 /usr/bin/freshclam -d --foreground=true

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .