Hello N. Sakai, I haven't used AIX but did you enable FIPS on the OS? The clamav Signatures use MD5 or SHA1 hashing and does not work with FIPS enabled and can cause that error message to appear.
https://github.com/Cisco-Talos/clamav/issues/564 On Red Hat Enterprise Linux 9 with FIPS enabled, I get "can't allocate memory" errors in the log file for the clamd@scan service. Hong-Duc Vu -----Original Message----- From: N.Sakai <[email protected]> Sent: Monday, June 30, 2025 1:56 AM To: ClamAV users ML <[email protected]> Subject: [clamav-users] AIX and Clamd scan error, "Can't allocate memory ERROR" Hello everyone, I would like to consult with you regarding an error that I have encountered while scanning with ClamAV 1.0.7 on AIX 7.3, particularly with clamd, which is not something I have encountered often. On multiple AIX servers that I support for management, an occurrence happened where, at almost the same timing when files were scanned by clamd, all the scans recorded a "Can't allocate memory ERROR" and failed as follows; Fri Jun 27 18:24:10 2025 -> /opt/app/bin: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/bin/a.out: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/bin/check.sh: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/bin/data01: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/bin/upd.sh: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/contrib/.subsystem: Can't allocate memory ERROR Fri Jun 27 18:24:10 2025 -> /opt/app/contrib/user.conf: Can't allocate memory ERROR I remember that in former versions of ClamAV, similar errors occurred with certain file formats. Also, I have encountered situations where clamd failed to start in a memory-constrained environment or shut down during scanning several times. However, in this environment, the server has 32GB of memory, and about 10GB of free memory is secured according to svmon. The scan targets include simple text files of just a few KB as well as program files of several MB, but they do not include archives or large files. The same "Can't allocate memory ERROR" has occurred for all files that were scanned, without exception. I am not well-versed in the internal structure of clamd, but I understand that clamd operates in a multi-threaded manner during object scanning (it launches new threads and assigns them to scanning), so I checked the ulimit settings for AIX threads and processes, as well as memory. ulimit -a time(seconds) unlimited file(blocks) unlimited data(kbytes) unlimited stack(kbytes) 4194304 memory(kbytes) unlimited coredump(blocks) 2097151 nofiles(descriptors) 8000 threads(per process) unlimited processes(per user) 16384 Looking at this, it doesn't seem that any particularly problematic values are set. What could be the reasons for clamd returning this kind of error for all scan requests? Thank you in advance. _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
