Mailing List Archive: [clamav-users] clamdscan "Can't get file status ERROR"

[clamav-users] clamdscan "Can't get file status ERROR"

Jun 21, 2021, 8:45 AM

Post #1 of 5 (521 views)

Hi,

I'm using ClamAV 0.101.1/26207 with default clamd.config settings (except
for enhanced logging)

I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned,
and I don't know why. Maybe you could help me somehow? All the other PDFs
do not throw an error.

Log:
Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1236
Mon Jun 21 16:50:30 2021 -> $Got new connection, FD 1352
Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 30 seconds
Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1352
Mon Jun 21 16:50:30 2021 -> $got command CONTSCAN c:\path\file.pdf (77, 7),
argument: c:\path\file.pdf
Mon Jun 21 16:50:30 2021 -> $mode -> MODE_WAITREPLY
Mon Jun 21 16:50:30 2021 -> $Breaking command loop, mode is no longer
MODE_COMMAND
Mon Jun 21 16:50:30 2021 -> $Consumed entire command
Mon Jun 21 16:50:30 2021 -> $Number of file descriptors polled: 0 fds
Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 600 seconds
Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
-> signaling
Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
signaling
Mon Jun 21 16:50:30 2021 -> ~c:\path\file.pdf: Can't get file status ERROR
Mon Jun 21 16:50:30 2021 -> $Finished scanthread
Mon Jun 21 16:50:30 2021 -> $Scanthread: connection shut down (FD 1352)
Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
-> signaling
Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
signaling

What does that mean?

Best regards, Roger

Re: [clamav-users] clamdscan "Can't get file status ERROR" [ In reply to ]

clamav-users at lists

Jun 21, 2021, 9:18 AM

Post #2 of 5 (521 views)

Permalink

On Mon, 21 Jun 2021, Roger Rutishauser wrote:

> I'm using ClamAV 0.101.1/26207 with default clamd.config settings (except
> for enhanced logging)

Please update to the latest version 0.103.2
See many recent messages in this list -
you could be blocked for using an older version.

> I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned,
> and I don't know why. Maybe you could help me somehow? All the other PDFs
> do not throw an error.

You say the file is 2 GB.
There is a file size limit of 2GB - 2^31 bytes.
*Maybe* you are hitting that.

This is a hard limit until the developers can make the code 63?64bit
clean.

> Log:
> Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1236
> Mon Jun 21 16:50:30 2021 -> $Got new connection, FD 1352
> Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 30 seconds
> Mon Jun 21 16:50:30 2021 -> $Received POLLIN|POLLHUP on fd 1352
> Mon Jun 21 16:50:30 2021 -> $got command CONTSCAN c:\path\file.pdf (77, 7),
> argument: c:\path\file.pdf
> Mon Jun 21 16:50:30 2021 -> $mode -> MODE_WAITREPLY
> Mon Jun 21 16:50:30 2021 -> $Breaking command loop, mode is no longer
> MODE_COMMAND
> Mon Jun 21 16:50:30 2021 -> $Consumed entire command
> Mon Jun 21 16:50:30 2021 -> $Number of file descriptors polled: 0 fds
> Mon Jun 21 16:50:30 2021 -> $fds_poll_recv: timeout after 600 seconds
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
> -> signaling
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
> signaling
> Mon Jun 21 16:50:30 2021 -> ~c:\path\file.pdf: Can't get file status ERROR
> Mon Jun 21 16:50:30 2021 -> $Finished scanthread
> Mon Jun 21 16:50:30 2021 -> $Scanthread: connection shut down (FD 1352)
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (single) crossed low threshold
> -> signaling
> Mon Jun 21 16:50:30 2021 -> $THRMGR: queue (bulk) crossed low threshold ->
> signaling
>
> What does that mean?
>
> Best regards, Roger

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] clamdscan "Can't get file status ERROR" [ In reply to ]

clamav-users at lists

Jun 21, 2021, 9:50 AM

Post #3 of 5 (521 views)

Permalink

Hi there,

On Mon, 21 Jun 2021, Andrew C Aitchison via clamav-users wrote:
> On Mon, 21 Jun 2021, Roger Rutishauser wrote:
>
>> I'm using ClamAV 0.101.1/26207 with default clamd.config settings (except
>> for enhanced logging)
>
> Please update to the latest version 0.103.2 ...

+1

>> I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned

Even for a PDF file, 2Gbytes is pretty big. What is it?

>> ... I don't know why. Maybe you could help me somehow? All the other PDFs
>> do not throw an error.
>
> You say the file is 2 GB.
> There is a file size limit of 2GB - 2^31 bytes.
> *Maybe* you are hitting that.

The OP claims that, except for logging, he's using default settings.
The default settings (at least as distributed on clamav.net) do not
permit scanning files larger than 25 Mbytes. Please see the various
'Max...' options in the configuration file. They are well-covered in
the documentation, which warns about setting limit values too high as
it can cause problems. The warnings are a little draconian in my view
but they are still warnings.

In any case make sure that the process which is trying to scan the
file has the permissions which it needs to access it.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[clamav-users] clamdscan "Can't get file status ERROR" [ In reply to ]

r.rutishauser at docuteam

Jun 23, 2021, 4:46 AM

Post #4 of 5 (520 views)

Permalink

Thanks Ged and Andrew

> Hi there,
>
> On Mon, 21 Jun 2021, Andrew C Aitchison via clamav-users wrote:
> > On Mon, 21 Jun 2021, Roger Rutishauser wrote:
> >
> >> I'm using ClamAV 0.101.1/26207 with default clamd.config settings
(except
> >> for enhanced logging)
> >
> > Please update to the latest version 0.103.2 ...
>
> +1

done.

>
> >> I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned
>
> Even for a PDF file, 2Gbytes is pretty big. What is it?
>
> >> ... I don't know why. Maybe you could help me somehow? All the other
PDFs
> >> do not throw an error.
> >
> > You say the file is 2 GB.
> > There is a file size limit of 2GB - 2^31 bytes.
> > *Maybe* you are hitting that.
>
> The OP claims that, except for logging, he's using default settings.
> The default settings (at least as distributed on clamav.net) do not
> permit scanning files larger than 25 Mbytes. Please see the various
> 'Max...' options in the configuration file. They are well-covered in
> the documentation, which warns about setting limit values too high as
> it can cause problems. The warnings are a little draconian in my view
> but they are still warnings.

I changed the following in clamdscan.conf:
StreamMaxLength 3000M
MaxScanSize 3000M
MaxFileSize 3000M

> In any case make sure that the process which is trying to scan the
> file has the permissions which it needs to access it.

i checked that

Still, I'm getting the same error.

Command:
C:\....\clamAV>clamdscan c:\path\file.pdf

CMD Console Output:
C:\path\file.pdf: Can't get file status ERROR

----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.006 sec (0 m 0 s)
Start Date: 2021:06:23 13:42:40
End Date: 2021:06:23 13:42:40

Re: [clamav-users] clamdscan "Can't get file status ERROR" [ In reply to ]

clamav-users at lists

Jun 23, 2021, 4:57 AM

Post #5 of 5 (520 views)

Permalink

Hi there,

On Wed, 23 Jun 2021, Roger Rutishauser wrote:
>> On Mon, 21 Jun 2021, Andrew C Aitchison via clamav-users wrote:
>>> On Mon, 21 Jun 2021, Roger Rutishauser wrote:
>>>
>>> I have a PDF (size: 2 GB, PUID fmt/478, PDF/A) which can not be scanned
>>
>> ... There is a file size limit of 2GB - 2^31 bytes. ...
>
> I changed the following in clamdscan.conf:
> StreamMaxLength 3000M
> MaxScanSize 3000M
> MaxFileSize 3000M

What's wrong with this picture?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml