By default, ClamAV ignores files lager than 25M. When I try to scan a big file, 700M, I have this output :
➜ clamscan file.avi
/home/dougui/Videos/file.avi: OK
----------- SCAN SUMMARY -----------
Known viruses: 8284573
Engine version: 0.102.4
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 700.61 MB (ratio 0.00:1)
Time: 13.149 sec (0 m 13 s)
The file is marked as correct. When I run the command with --debug
, I have this log :
...
LibClamAV debug: Checking realpath of file.avi
LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16)
LibClamAV debug: cli_updatelimits: scansize exceeded (initial: 104857600, consumed: 0, needed: 734642176)
LibClamAV debug: cli_updatelimits: filesize exceeded (allowed: 26214400, needed: 734642176)
LibClamAV debug: emax_reached: marked parents as non cacheable
LibClamAV debug: cli_magic_scandesc: returning 0 at line 3314 (no post, no cache)
/home/dougui/Videos/file.avi: OK
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Freeing phishcheck struct
LibClamAV debug: Phishcheck cleaned up
It seems that scansize and filesize are exceeded. There is also a difference between "Data scanned" and "Data read" in summary. I found the option --alert-exceeds-max
to display when a find is skipped
The problem is I don't find the same option with clamdscan
. I tried to change the config and checked in log file but didn't found anything.
How can I see which files are skipped in Deamon mode ?
Asked by Dougui
(241 rep)
Jul 29, 2020, 07:22 PM
Last activity: Jun 29, 2023, 01:04 AM
Last activity: Jun 29, 2023, 01:04 AM