On Fri, Apr 25, 2014 at 10:35 AM, SR <srju...@gmail.com> wrote: > Hello everyone, > > I have happily been using Clamav on our file server for more than a year > now. > The scan of the different volumes is done by clamdscan which is ran > from cron jobs. > > The problem that I am facing since a few weeks, is that the scans are > not performed to completion because clamdscan terminates with an error > that says: Can't allocate memory ERROR. > > The error occurs on very large files (equal or bigger than the amount > of RAM in the server). Previously, I never had any problems with > these files as I assume clamdscan was skipping over them. > > I tried to alter my clamd.conf file to specify a MaxScanSize and I > also set the ExitOnOOM option to false. But I was not successful. I > did restart clamav-daemon. > > I experimented with the "CLI" clamscan "without the D", surprisingly, > although the same memory errors are reported the offending files are > ignored and the scan continues. > > Here is the error message when the following command is ran: > clamscan -rv --debug > /media/backup/inspiron/stephen/Documents/Nikon/Outlook/ > > Scanning /media/backup/inspiron/stephen/Documents/Nikon/Outlook/archive.pst > LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16) > LibClamAV Warning: fmap: map allocation failed > LibClamAV Error: CRITICAL: fmap() failed > LibClamAV debug: cli_magic_scandesc: returning 20 at line 2932 (no > post, no cache) > /media/backup/inspiron/stephen/Documents/Nikon/Outlook/archive.pst: > Can't allocate memory ERROR > > As mentioned before, clamscan seems to report the error and skip over > large files as opposed to clamDscan which to stop as soon as a large > file causing the memory allocation error is encountered. > > If someone has explanations and/or recommendations, I would be glad to > learn. >
Hey Stephen, How big is that file? How much RAM (physical and swap separate, please) is installed on the scanning machine? Currently, ClamAV has a hard file limit of around 2.17GB. Because we're mapping the file into memory, if you don't have enough memory available to map the whole file, the memory mapping code (as currently implemented) will fail and the file won't be scanned. One of our long-term goals is to investigate being able to properly support large files. Thanks, Shawn _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml
