[clamav-users] Trying to track down bug using lsof & clamscan/clamdscan.. odd behavior

Alexander Urcioli alexurc at gmail.com
Thu Aug 27 20:51:56 UTC 2015

Ah, I thought it would be something like that (mmap) but also yes my
MaxScanSize setting was at 100 MB. Thank you for the prompt reply. At this
point I am skeptical of my hypothesis that clamav is not releasing the file.


On Thu, Aug 27, 2015 at 4:48 PM, Charles Swiger <cswiger at mac.com> wrote:

> On Aug 27, 2015, at 1:13 PM, Alexander Urcioli <alexurc at gmail.com> wrote:
> > We were running into an issue where larger files were not able to be
> moved
> > after scanning with ClamAV. Our hypothesis was that perhaps the process
> has
> > not released access to the file and we were experiencing a race
> condition.
> >
> > Upon investigating I attempted to monitor the file we were scanning using
> > lsof on repeat mode. To my suprise, upon scanning a 900MB file with
> > clamscan and clamdscan, lsof never lists the file as being opened
> > by....anything...
> It's not unusual for programs to read file data via mmap() rather than
> open().
> That said, it's also quite possible that a 900 MB file is being skipped
> entirely
> due to MaxScanSize setting, which defaults to 100 MB unless you have
> changed it.
> Regards,
> --
> -Chuck
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> http://www.clamav.net/contact.html#ml

More information about the clamav-users mailing list