[clamav-users] Inquiry about ClamAV's MaxFileSize

[Micah Snyder (micasnyd)]

Hi Nozomi Tachibanaki,

In ClamAV 0.105 we increased the max file size and max scan size.
If your clamd.conf setting does not also raise the MaxScanSize setting, then it is likely you would experience the `Heuristics.Limits.Exceeded.MaxFileSize FOUND" alert in 0.103.7 and possibly also in 1.0.1, depending on the file you're scanning.

Sorry about the delayed response.

Regards,
Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

________________________________
From: clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of Tachibanaki Nozomi (橘木 希美) <nozomi.tachibanaki at jp.ricoh.com>
Sent: Tuesday, April 18, 2023 7:27 PM
To: clamav-users at lists.clamav.net <clamav-users at lists.clamav.net>
Cc: Hino Shogo (日野 翔豪) <Shogo.Hino at jp.ricoh.com>; Sugawara Masatomo (菅原 正大) <masatomo.sugawara at jp.ricoh.com>
Subject: [clamav-users] Inquiry about ClamAV's MaxFileSize


Dear Sir or Madam,



Thank you for your help always.

The purpose of this email is to inquire about ClamAV's MaxFileSize.



We are currently using ClamAV version 0.103.7.

We are planning to update to version 1.0.1 and are testing it.

When AlertExceedsMax is set to yes and a file with the same number of bytes as MaxFileSize is scanned,

In version 0.103.7, the message "Heuristics.Limits.Exceeded.MaxFileSize FOUND with AlertExceedsMax" is output, but in version 1.0.1, the message is no longer displayed. Is this a specification?



The clamd.conf setting is as follows

・MaxFileSize 2048M



The log of clamd demon is as follows.

・clamd daemon 1.0.1 (OS: Linux, ARCH: x86_64, CPU: x86_64)

・Limits: File size limit set to 2147483648 bytes.



The verification file was created using the following command

・fsutil file createnew 2.0G.dat 2147483648





I’m looking forward to hearing from you.

Yours sincerely,





Nozomi Tachibanaki




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20230426/8c85eb35/attachment.htm>