Hi there,
On Fri, 8 Nov 2019, Markus Kolb via clamav-users wrote:
Am 08.11.2019 11:58, schrieb G.W. Haywood via clamav-users:
> On Fri, 8 Nov 2019, Arnaud Jacques wrote:
> ...Brent wrote:
[...]
> > clamscan --alert-exceeds-max=yes --max-recursion=5 --max-ziptypercg=5M
> > /var/tmp/tmp/zbxl.zip: Heuristics.Limits.Exceeded FOUND
>
> It seems that there might be room for improvement in Brent's client's
> ClamAV configuration, perhaps we should be trying to understand why it
> is in this state. It should be a deliberate choice to disable a test
> for excessive resource usage, not an accident.
The alerting on exceed is disabled by default.
Ah, good point. I'd forgotten that long ago I'd set 'AlertExceedsMax' to
'yes' in the base configuration that I usually use as a starting point.
Maybe that should default to 'yes', perhaps with higher values for some of
the limits if that's an issue? I must say that I don't recall any problems
with the default values for archive limits in many years of using ClamAV.
There was one contract draughtsman who for some time insisted on sending 30-
megabyte emails to the QA manager at his client, but it was a Sendmail limit
which rejected the messages, not ClamAV. In the end they stopped using him. :/
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
