[clamav-users] Trying to track down bug using lsof & clamscan/clamdscan.. odd behavior

[Charles Swiger]

On Aug 27, 2015, at 1:13 PM, Alexander Urcioli <alexurc at gmail.com> wrote:
> We were running into an issue where larger files were not able to be moved
> after scanning with ClamAV. Our hypothesis was that perhaps the process has
> not released access to the file and we were experiencing a race condition.
> 
> Upon investigating I attempted to monitor the file we were scanning using
> lsof on repeat mode. To my suprise, upon scanning a 900MB file with
> clamscan and clamdscan, lsof never lists the file as being opened
> by....anything...

It's not unusual for programs to read file data via mmap() rather than open().

That said, it's also quite possible that a 900 MB file is being skipped entirely
due to MaxScanSize setting, which defaults to 100 MB unless you have changed it.

Regards,
-- 
-Chuck