Hi Micah,

Thanks for the information. !

I think I framed my problem statement differently. So, our requirement is similar the one asked by John in the below link. I do not know if the solution proposed is a correct one..

Also, how do you propose I should scan an archive of 100GB ( let's say) size.

Does clamav have any limitations on scanning a single file of such huge size ??

Please suggest.

https://clamav-users.clamav.narkive.com/azQ8KJeO/calling-clamd-instream-on-blocks-of-data-can-a-virus-sneak-by-the-edge-of-a-block

Sent from Yahoo Mail on Android

On Thu, 24 Jan 2019 at 9:45 PM, Micah Snyder (micasnyd)
<micasnyd@cisco.com> wrote:
Unfortunately, ClamAV is not designed to parse and scan chunks of files individually. ClamAV does file typing by pattern matching starting from the beginning of a file.  Without this information, ClamAV won't know what type of file it is scanning and will treat it as generic binary or text data.  Further, if the files are compressed in any way, ClamAV won't be able to extract them without the entire file. 

Regards,
Micah
 
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jan 24, 2019, at 7:21 AM, Kushal Kumar <kkushal05@yahoo.com> wrote:

Hi,


We have a production use case where we have to scan very large files of size 10 GB - 200 GB. So while the files are uploading in chunks, we want to scan these chunks by passing this as an input stream to clam av.
Since, clam av supports input stream scanning, we need to know if this is achievable or not using clam av ?

Also, if the virus signature is spread across two chunks and clam av does not detect them on individual chunk scanning, but when these chunks assemble on filesystem the infected signature can get active.  Does clamav has any support to handle such scenarios ?

Best,
Kushal Kumar
Verizon, India

_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml