Hi there, On Thu, 7 Jan 2021, Kevin Faber via clamav-users wrote:
We are using c-icap to interface with ClamAV 0.103.0 and seeing the following error in the clamd.scan log file when scanning large files. The RHEL host has 8gb of ram and is attempting to scan a 9gb file. Are there any configuration changes that can be made to fix this or do we just increase ram? fd[21]: Can't allocate memory ERROR
What is it that you're scanning, and why do you want to scan it? Please read the documentation and the configuration files, and search the list archives for information about maximum scan sizes which are discussed here now and again, e.g. https://marc.info/?l=clamav-users&m=157549176313237&w=2 Basically you can't usefully scan anything bigger than about 4GBytes, for some cases 2GBytes. In most cases I think it's probably futile to try to scan such large files anyway. Chopping them into pieces so as to scan the pieces begs all sorts of questions. If they're archives of multiple files you could extract the contents to scan separately. It's possible to construct a tiny compressed archive file which will produce ridiculously large files when uncompressed, or perhaps e.g. trigger some regex issue in a scanner, resulting in denial of service. Don't do it. Sometimes people want to scan the disc images of their filesystems, or those of virtual machines. Try not to do that either. -- 73, Ged. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
