[clamav-users] clamdscan "Can't get file status ERROR"

[Andrew C Aitchison]

On Mon, 21 Jun 2021, Roger Rutishauser wrote:

> I'm using ClamAV 0.101.1/26207 with default clamd.config settings (except
> for enhanced logging)

Please update to the latest version 0.103.2
See many recent messages in this list -
you could be blocked for using an older version.

> I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned,
> and I don't know why. Maybe you could help me somehow? All the other PDFs
> do not throw an error.

You say the file is 2 GB.
There is a file size limit of 2GB - 2^31 bytes.
*Maybe* you are hitting that.

This is a hard limit until the developers can make the code 63?64bit 
clean.

> Log:
> Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1236
> Mon Jun 21 16:50:30 2021 -> $Got new connection, FD 1352
> Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 30 seconds
> Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1352
> Mon Jun 21 16:50:30 2021 -> $got command CONTSCAN c:\path\file.pdf (77, 7),
> argument: c:\path\file.pdf
> Mon Jun 21 16:50:30 2021 -> $mode -> MODE_WAITREPLY
> Mon Jun 21 16:50:30 2021 -> $Breaking command loop, mode is no longer
> MODE_COMMAND
> Mon Jun 21 16:50:30 2021 -> $Consumed entire command
> Mon Jun 21 16:50:30 2021 -> $Number of file descriptors polled: 0 fds
> Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 600 seconds
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
> -> signaling
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
> signaling
> Mon Jun 21 16:50:30 2021 -> ~c:\path\file.pdf: Can't get file status ERROR
> Mon Jun 21 16:50:30 2021 -> $Finished scanthread
> Mon Jun 21 16:50:30 2021 -> $Scanthread: connection shut down (FD 1352)
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
> -> signaling
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
> signaling
>
> What does that mean?
>
> Best regards, Roger

-- 
Andrew C. Aitchison					Kendal, UK
 			andrew at aitchison.me.uk