Mailing List Archive

Can't allocate memory ERROR
Hello,

We are using c-icap to interface with ClamAV 0.103.0 and seeing the following error in the clamd.scan log file when scanning large files.

The RHEL host has 8gb of ram and is attempting to scan a 9gb file. Are there any configuration changes that can be made to fix this or do we just increase ram?

fd[21]: Can't allocate memory ERROR

Thanks,
Kevin

___________________________________________________________________________________________________________________________________________________________________________________________________________________ DISCLAIMER: This message (including any attachments) may contain confidential, proprietary, privileged and/or private information. The information is intended to be for the use of the individual or entity designated above. If you are not the intended recipient of this message, please notify the sender immediately, and delete the message and any attachments. Any disclosure, reproduction, distribution or other use of this message or any attachments by an individual or entity other than the intended recipient is prohibited. The security of our clients is a top priority. Therefore, we have put efforts into ensuring that the message is error and virus-free. Unfortunately, full security of the email cannot be ensured as, despite our efforts, the data included in emails could be infected, intercepted, or corrupted. Therefore, the recipient should check the email for threats with proper software, as the sender does not accept liability for any damage inflicted by viewing the content of this email.
Re: Can't allocate memory ERROR [ In reply to ]
Hi there,

On Thu, 7 Jan 2021, Kevin Faber via clamav-users wrote:

> We are using c-icap to interface with ClamAV 0.103.0 and seeing the following error in the clamd.scan log file when scanning large files.
>
> The RHEL host has 8gb of ram and is attempting to scan a 9gb file. Are there any configuration changes that can be made to fix this or do we just increase ram?
>
> fd[21]: Can't allocate memory ERROR

What is it that you're scanning, and why do you want to scan it?

Please read the documentation and the configuration files, and search
the list archives for information about maximum scan sizes which are
discussed here now and again, e.g.

https://marc.info/?l=clamav-users&m=157549176313237&w=2

Basically you can't usefully scan anything bigger than about 4GBytes,
for some cases 2GBytes. In most cases I think it's probably futile to
try to scan such large files anyway. Chopping them into pieces so as
to scan the pieces begs all sorts of questions. If they're archives
of multiple files you could extract the contents to scan separately.

It's possible to construct a tiny compressed archive file which will
produce ridiculously large files when uncompressed, or perhaps e.g.
trigger some regex issue in a scanner, resulting in denial of service.
Don't do it. Sometimes people want to scan the disc images of their
filesystems, or those of virtual machines. Try not to do that either.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: Can't allocate memory ERROR [ In reply to ]
Some users have reported an issue where the file size limits aren't working for files larger than 2GB. If your MaxFileSize is default or is otherwise set less than 2GB and you're still seeing this error it may be the same issue. See:
- https://bugzilla.clamav.net/show_bug.cgi?id=12374
- https://bugzilla.clamav.net/show_bug.cgi?id=12649

I haven't yet investigated, but I'm hoping to look into this bug in the coming weeks.

Regards,
Micah

> -----Original Message-----
> From: clamav-users <clamav-users-bounces@lists.clamav.net> On Behalf Of
> G.W. Haywood via clamav-users
> Sent: Thursday, January 7, 2021 9:32 AM
> To: Kevin Faber via clamav-users <clamav-users@lists.clamav.net>
> Cc: G.W. Haywood <clamav@jubileegroup.co.uk>
> Subject: Re: [clamav-users] Can't allocate memory ERROR
>
> Hi there,
>
> On Thu, 7 Jan 2021, Kevin Faber via clamav-users wrote:
>
> > We are using c-icap to interface with ClamAV 0.103.0 and seeing the
> following error in the clamd.scan log file when scanning large files.
> >
> > The RHEL host has 8gb of ram and is attempting to scan a 9gb file. Are there
> any configuration changes that can be made to fix this or do we just increase
> ram?
> >
> > fd[21]: Can't allocate memory ERROR
>
> What is it that you're scanning, and why do you want to scan it?
>
> Please read the documentation and the configuration files, and search the list
> archives for information about maximum scan sizes which are discussed here
> now and again, e.g.
>
> https://marc.info/?l=clamav-users&m=157549176313237&w=2
>
> Basically you can't usefully scan anything bigger than about 4GBytes, for some
> cases 2GBytes. In most cases I think it's probably futile to try to scan such
> large files anyway. Chopping them into pieces so as to scan the pieces begs all
> sorts of questions. If they're archives of multiple files you could extract the
> contents to scan separately.
>
> It's possible to construct a tiny compressed archive file which will produce
> ridiculously large files when uncompressed, or perhaps e.g.
> trigger some regex issue in a scanner, resulting in denial of service.
> Don't do it. Sometimes people want to scan the disc images of their
> filesystems, or those of virtual machines. Try not to do that either.
>
> --
>
> 73,
> Ged.
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml