[clamav-users] Scanning very large files in chunks

Reindl Harald h.reindl at thelounge.net
Tue Aug 9 12:59:19 EDT 2016



Am 09.08.2016 um 18:40 schrieb G.W. Haywood:
>> Does anybody have any feedback on the proposed solution to scanning
>> large files in chunks?
>
> Stop worrying about it, it's a waste of time and effort.  The probability
> that you will actually find what you're looking for is very small.
>
>> ... are there any reasons that the method wouldn't work for all file
>> types, assuming that the initial bytes of the file are prepended to
>> each chunk so that ClamAV knows what type of file it is?
>
> Yes.  Because of what I wrote above.  Forget prepended bytes and fancy
> ways of doing things that won't solve the problem.  Look at the problem
> in a different way.  I'm sure this isn't what you want to hear, but it's
> the way things are.

on the other hand contentscanner limits are often around 260 KB with the 
justification of "scantime maybe so much higher and nobody is sending 
such large spam because of the sendrate" - in the meantime it's common 
to have junk with a large attachment to just bypass the filter

back to clamav:
and if you scan "only" 20 MB files and not gigabytes - why should it be 
a goal to allocate that memory at once to make troubles in case of 
*parallel scans* like on a mailserver

that and that the meory usage of the signatures is already terrible 
shows that clamav *will have* to deal with that problems in the future 
since it#s already the main memory consumer on a inbound mailserver

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20160809/675853b1/attachment.sig>


More information about the clamav-users mailing list