Sample Header Ad - 728x90

Warnings/Errors when running clamav/clamscan, scanning 3TB hard-drive

9 votes
1 answer
23057 views
**What I'm trying to do**: I'm trying to scan my File-Server for malware, and I'm using clamav/clamscan, where the man page say's it can scan files up to 4GB. This man page states: --max-filesize=#n > Extract and scan at most #n kilobytes from each archive. You may pass > the value in megabytes in format xM or xm, where x is a number. This > option protects your system against DoS attacks (default: 25 MB, max: > Extract and scan at most #n kilobytes from each scanned file. You may > pass the value in megabytes in format xM or xm, where x is a number. > This option protects your system against DoS attacks (default: 100 MB, > max: How big is that file? How much RAM (physical and swap separate, > please) is installed on the scanning machine? Currently, ClamAV has a > hard file limit of around 2.17GB. Because we're mapping the file into > memory, if you don't have enough memory available to map the whole > file, the memory mapping code (as currently implemented) will fail and > the file won't be scanned. > > One of our long-term goals is to investigate being able to properly > support large files. **Possible solution**: Hope the above is the problem(not enough memory), then I can simply extend the systems memory to 8GB, but it's unlikely it is so simple because I tried to run those scans on a system with 12GB ram. **EDIT #1** Here is a run on another system with Fedora 21 + 12 GB RAM: clamscan -r -i --remove --max-filesize=1700M --max-scansize=1700M --exclude=/proc --exclude=/sys --exclude=/dev / --------------------------------- LibClamAV Warning: [Bytecode JIT]: recovered from error LibClamAV Warning: [Bytecode JIT]: JITed code intercepted runtime error! LibClamAV Warning: [Bytecode JIT]: Bytecode run timed out, timeout flag set LibClamAV Warning: Bytcode 27 failed to run: Time limit reached LibClamAV Error: cli_scanxz: premature end of compressed stream LibClamAV Error: cli_scanxz: premature end of compressed stream ------------------------------- ----------- SCAN SUMMARY ----------- Known viruses: 3779101 Engine version: 0.98.6 Scanned directories: 101382 Scanned files: 744103 Infected files: 0 Total errors: 18419 Data scanned: 285743.78 MB Data read: 394739.73 MB (ratio 0.72:1) Time: 32171.073 sec (536 m 11 s) when I ran those same scans on it with sizes set to 2100M-4000M it gave the same errors as mentioned in my original question.
Asked by somethingSomething (6209 rep)
Mar 28, 2015, 06:52 AM
Last activity: Apr 16, 2023, 08:24 AM