[clamav-users] Heuristics.Limits.Exceeded FOUND

[Kris Deugau]

Arjen de Korte via clamav-users wrote:
> Citeren Paul Kosinski via clamav-users <clamav-users at lists.clamav.net>:

>> However, applying clamscan to this file (which was slightly renamed by
>> my download script to be more readable) results in the following output:
>>
>> clamscan --alert-exceeds-max=yes --max-scantime=999 
>> --max-scansize=4090M --max-filesize=4090M --max-files=30000 
>> --max-recursion=30 --pcre-match-limit=999999999 
>> --pcre-max-filesize=999999999    firefox-68.6.1-esr-64.tar.bz2
>>

> Before writing this whole rant, you have not considered checking which 
> of the options might have triggered this? You've reduced the 
> --max-scantime from the default 120 seconds to under 1 second and still 
> wonder why this breaks? Really?

That option seems to be missing from the man page entirely:

$ dpkg -l clamav
ii  clamav         0.102.1+dfsg-0+deb10u2          amd64 [...]
$ zgrep scantime /usr/share/man/man1/clamscan.1.gz
$


and does not specify units in the --help text:

$ clamscan --help
[...]
     --max-scantime=#n                    Scan time longer than this 
will be skipped and assumed clean
[...]

Absent any documentation, I would reasonably assume this to be in 
seconds, not milliseconds.

I have no idea if you're wrong about this being the cause, but without 
diving into the source, Paul's use of that option looks entirely 
reasonable to me.

-kgd