Topic: clamav scan crashes server

[Casper]

The weekly smeserver-clamscan is locking up my server every monday morning.  It runs for about 15 minutes and then the whole box just locks up, and I can't log in through the console.  This started about 3 weeks ago, and it happens every time without fail.  I'm guessing there's a particular file it's b0rking on, but I'm having difficulty locating which one.  Running it through strace doesn't seem to work, and I can't seem to get on  the clamav-users mailing list to ask for help.  Any suggestions on how to identify the problem?  

 Casper.

[raem]

Casper

There is an issue with clamscan scanning very large files and also mounted drives eg while runnning a backup2 job. Search forums for clamscan.

[Casper]

Had a quick search for previous relevant posts, couldn't seem to find any.  There are some large files on the server (1.1GB is the biggest), but I would think clamav would ignore scanning for large files (or if not, where can I configure this?)  Also, it still crashes with or without a backup running at the same time, and there are no mounted drives.

Casper.

[raem]

Casper

> Had a quick search for previous relevant posts
> There are some large files on the server (1.1GB is the biggest)

You have to configure clamscan to ignore large files and I seem to recall that the problem was 800Mb or larger (approx).
I'm fairly sure it was answered in the forums, so you probably need to search somewhat longer than you did if you really want the answer.

Try searching on clamscan & clamav

[dmajwool]

Ray.

# clamscan --help

doesn't seem to display a max filesize parameter.

If such a parameter exists, would it necessarily be in the help file listing?  I don't know if it is normal for programmes to reserve some parameters from the cli.

Thanks, David.

[raem]

Casper & dmajwool

See this bug
http://bugs.contribs.org/show_bug.cgi?id=1660

which mentions this
The following command should alert you to any potential files that might be causing issues with the virus scanner.

find / -size +1562500 -ls

This will check for any file on the system that is larger then 800M (1562500 *
512b blocks).  If that doesn't turn anything up then you might want to try with
1171875 (600M).


See these links to help tailor the scan to exclude certain directories

http://forums.contribs.org/index.php?topic=33393.0

http://forums.contribs.org/index.php?topic=33160.0

[Casper]

See this bug
http://bugs.contribs.org/show_bug.cgi?id=1660

I tried replying to this bug, but didn't have a login.  Anyway, I dispute it -- I can scan large files with clamscan, (1.7GB at least) with no problems.   Others on the clamav-users list can confirm this too.  I think my problems are actually hardware-related, judging by the fact I've just seen the server lock up whilst clamscan isn't running.

Casper.

[raem]

Casper

> http://bugs.contribs.org/show_bug.cgi?id=1660[/quote]

> I tried replying to this bug, but didn't have a login.

It would be good if you would create a login at bugzilla and add your comments, even if it is just a copy of this thread. That way the real problem can be sorted out.

Thanks