[clamav-users] Heuristics.Limits.Exceeded FOUND

[Micah Snyder (micasnyd)]

Apologies for the confusion.  We actually merged a fix to the man page, help output for this option a couple days ago: 
https://github.com/Cisco-Talos/clamav-devel/commit/6e17eb5e97dbb0529dea47e15fd35b5fa79565de#diff-6426d2040de12e907d62da86807e7ca8

-Micah

On 4/3/20, 5:18 PM, "clamav-users on behalf of Kris Deugau" <clamav-users-bounces at lists.clamav.net on behalf of kdeugau at vianet.ca> wrote:

    Arjen de Korte via clamav-users wrote:
    > Citeren Paul Kosinski via clamav-users <clamav-users at lists.clamav.net>:
    
    >> However, applying clamscan to this file (which was slightly renamed by
    >> my download script to be more readable) results in the following output:
    >>
    >> clamscan --alert-exceeds-max=yes --max-scantime=999 
    >> --max-scansize=4090M --max-filesize=4090M --max-files=30000 
    >> --max-recursion=30 --pcre-match-limit=999999999 
    >> --pcre-max-filesize=999999999    firefox-68.6.1-esr-64.tar.bz2
    >>
    
    > Before writing this whole rant, you have not considered checking which 
    > of the options might have triggered this? You've reduced the 
    > --max-scantime from the default 120 seconds to under 1 second and still 
    > wonder why this breaks? Really?
    
    That option seems to be missing from the man page entirely:
    
    $ dpkg -l clamav
    ii  clamav         0.102.1+dfsg-0+deb10u2          amd64 [...]
    $ zgrep scantime /usr/share/man/man1/clamscan.1.gz
    $
    
    
    and does not specify units in the --help text:
    
    $ clamscan --help
    [...]
         --max-scantime=#n                    Scan time longer than this 
    will be skipped and assumed clean
    [...]
    
    Absent any documentation, I would reasonably assume this to be in 
    seconds, not milliseconds.
    
    I have no idea if you're wrong about this being the cause, but without 
    diving into the source, Paul's use of that option looks entirely 
    reasonable to me.
    
    -kgd
    
    _______________________________________________
    
    clamav-users mailing list
    clamav-users at lists.clamav.net
    https://lists.clamav.net/mailman/listinfo/clamav-users
    
    
    Help us build a comprehensive ClamAV guide:
    https://github.com/vrtadmin/clamav-faq
    
    http://www.clamav.net/contact.html#ml