search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.43k stars 706 forks source link

We have observed that when we are sending file more than 2G size Clam AV 1.3.1 which we have returns scan status. #1274

Closed clamavissue closed 5 months ago

clamavissue commented 5 months ago

Describe the bug

We are creating dataset with file >2GB size and observed clamav is scanning and returning clean status.

We wanted to know though documentation is saying that max file size clamav supported is 2GB then how it gives clean status for >2GB size files.

What is max file size for latest version of clamAV supports for scanning.

micahsnyder commented 5 months ago

ClamAV has multiple scan limits.

As of ClamAV 0.105, the main three limits are:

There are other limits. You can find information about them in the sample ClamD config file: https://github.com/Cisco-Talos/clamav/blob/rel/1.3/etc/clamd.conf.sample#L528

If you want to scan large files, you may need to increase one or more of those. Most commonly, you would increase MaxScanSize and MaxFileSize.

For these two in particular, you can set them to set the limits as high as ClamAV will allow. E.g. set MaxScanSize 0 and MaxFileSize 0 in clamd.conf for ClamD, or run ClamScan with clamscan --max-filesize=0 --max-scansize=0for ClamScan.

For MaxFileSize, the highest you can set it right now is 2G. Anything higher will still get capped at 2G.

The default behavior is to treat the file as clean if any of the scan limits are exceeded (scan time, scan size, file size, etc).

If you want an alert if the limits are exceeded, then you can use the following options: For ClamD, set "AlertExceedsMax yes" in the "clamd.conf" file. For ClamScan, use the "--alert-exceeds-max" option on the command line.

This will cause clamav to report one of the following signatures when the limits are exceeded:

If you're using the alert-exceeds-max feature and your file scan still says "OK", then no limit has been exceeded and nothing was found in your test file.

The ticket requesting support for scanning files larger than 2GB is here: https://github.com/Cisco-Talos/clamav/issues/344

clamavissue commented 5 months ago

Thank you for quick reply.