Ah, I thought it would be something like that (mmap) but also yes my MaxScanSize setting was at 100 MB. Thank you for the prompt reply. At this point I am skeptical of my hypothesis that clamav is not releasing the file.
Thanks On Thu, Aug 27, 2015 at 4:48 PM, Charles Swiger <cswi...@mac.com> wrote: > On Aug 27, 2015, at 1:13 PM, Alexander Urcioli <alex...@gmail.com> wrote: > > We were running into an issue where larger files were not able to be > moved > > after scanning with ClamAV. Our hypothesis was that perhaps the process > has > > not released access to the file and we were experiencing a race > condition. > > > > Upon investigating I attempted to monitor the file we were scanning using > > lsof on repeat mode. To my suprise, upon scanning a 900MB file with > > clamscan and clamdscan, lsof never lists the file as being opened > > by....anything... > > It's not unusual for programs to read file data via mmap() rather than > open(). > > That said, it's also quite possible that a 900 MB file is being skipped > entirely > due to MaxScanSize setting, which defaults to 100 MB unless you have > changed it. > > Regards, > -- > -Chuck > > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml > _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
