On Aug 27, 2015, at 1:13 PM, Alexander Urcioli <alex...@gmail.com> wrote: > We were running into an issue where larger files were not able to be moved > after scanning with ClamAV. Our hypothesis was that perhaps the process has > not released access to the file and we were experiencing a race condition. > > Upon investigating I attempted to monitor the file we were scanning using > lsof on repeat mode. To my suprise, upon scanning a 900MB file with > clamscan and clamdscan, lsof never lists the file as being opened > by....anything...
It's not unusual for programs to read file data via mmap() rather than open(). That said, it's also quite possible that a 900 MB file is being skipped entirely due to MaxScanSize setting, which defaults to 100 MB unless you have changed it. Regards, -- -Chuck _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
