[clamav-users] Input Stream Scanning for very large files

Kushal Kumar kkushal05 at yahoo.com
Thu Jan 24 12:06:54 EST 2019


Hi Micah,
Thanks for the information. !
I think I framed my problem statement differently. So, our requirement is similar the one asked by John in the below link. I do not know if the solution proposed is a correct one..
Also, how do you propose I should scan an archive of 100GB ( let's say) size.
Does clamav have any limitations on scanning a single file of such huge size ??
Please suggest.
https://clamav-users.clamav.narkive.com/azQ8KJeO/calling-clamd-instream-on-blocks-of-data-can-a-virus-sneak-by-the-edge-of-a-block

Sent from Yahoo Mail on Android 
 
  On Thu, 24 Jan 2019 at 9:45 PM, Micah Snyder (micasnyd)<micasnyd at cisco.com> wrote:   Unfortunately, ClamAV is not designed to parse and scan chunks of files individually. ClamAV does file typing by pattern matching starting from the beginning of a file.  Without this information, ClamAV won't know what type of file it is scanning and will treat it as generic binary or text data.  Further, if the files are compressed in any way, ClamAV won't be able to extract them without the entire file. 

Regards,Micah
 
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.



On Jan 24, 2019, at 7:21 AM, Kushal Kumar <kkushal05 at yahoo.com> wrote:
Hi,

We have a production use case where we have to scan very large files of size 10 GB - 200 GB. So while the files are uploading in chunks, we want to scan these chunks by passing this as an input stream to clam av.Since, clam av supports input stream scanning, we need to know if this is achievable or not using clam av ?
Also, if the virus signature is spread across two chunks and clam av does not detect them on individual chunk scanning, but when these chunks assemble on filesystem the infected signature can get active.  Does clamav has any support to handle such scenarios ?
Best,Kushal KumarVerizon, India
Sent from Yahoo Mail on Android_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190124/949e8510/attachment.html>


More information about the clamav-users mailing list