On Mon, 18 Oct 2010 14:53:59 -0700 (PDT) omonte7 <[email protected]> wrote:
> > Hello, my $TMPDIR (/tmp) is filling up while scanning (large files). > I'm running 0.96.3. I run daily scans on files changed within the > last 24 hours (which I put into a file and pass to clamd). I > configured clamd with the following: > > MaxThreads 1 > MaxDirectoryRecursion 1 > MaxScanSize 4294967296 > MaxFileSize 4294967296 > > my $TMPDIR (/tmp) is only 1G If you only have 1G free on /tmp set MaxFileSize to that. MaxFileSize also controls maximum size of file created. > in size and I know clamd does not fill > $TMPDIR with > a copy of the file and then scan it because I can scan a 4 Gig file > and $TMPDIR > does not fill up. However, at some point during a scan of large file > sizes (not > necessarily a large amount of files) $TMPRDIR fills up. > > So, my question is this, how does clamav use $TMPDIR and how can I > safely run > scans on files that average 3-4 Gigs in size. Don't scan files that large, did you ever find a virus in them? > > I found the following on another post which leads me to believe that > clamav copies (or something) the file it's scanning to $TMPDIR prior > to scanning but > I've tested this and found it to not be the case. The input file is not copied, but individual archive members are extracted to tmpdir, scanned, then removed. So you need space the size of the largest archive member. > > "> Could anyone please give me a bit more information about what kind > of > > damage might be involved, and how to choose safe non-default values > > for these settings? > > > > You should have enough space to scan MaxThreads * MaxFileSize * > MaxRecursion If you only scan 1 file at a time, then ignore the MaxThreads. Also the MaxRecursion is a worst case scenario, if you have space for MaxFileSize it should be good enough. Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
