<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Anthony,<br>
<br>
I have just hit the same problem on our installation of ZendTo here
at Southampton.<br>
<br>
I'm cc-ing this to the mailing list as it's going to become a
widespread problem.<br>
<br>
There's a bug in ClamAV 0.103.<br>
It crashes with a memory allocation failure if you try to scan a
file bigger than the available RAM in the server/VM.<br>
<br>
ClamAV 0.102 works fine.<br>
<br>
You can fetch the 0.102 RPMs from here:<br>
<a class="moz-txt-link-freetext" href="https://archives.fedoraproject.org/pub/archive/epel/7/x86_64/Packages/c/">https://archives.fedoraproject.org/pub/archive/epel/7/x86_64/Packages/c/</a><br>
<br>
Stop the services<br>
clamd@scan<br>
clam-freshclam<br>
clamav-freshclam<br>
Find all the clamAV RPMs you have installed:<br>
<tt> rpm -qa | grep -i clam</tt><br>
Then use "rpm -e" to remote all of them in 1 command. That stops
dependency problems.<br>
<br>
Then fetch the 0.102 versions from the URL above: you want to
install these<br>
clamav<br>
clamav-filesystem<br>
clamav-lib<br>
clamav-update<br>
clamd<br>
Do *not* install "clamav-data".<br>
<br>
Edit /etc/clamd.d/scan.conf. There's a commented out line mentioning
"LocalSocket".<br>
Uncomment that line.<br>
<br>
Edit /etc/freshclam.conf. There's a commented out line mentioning
"NotifyClamd".<br>
Uncomment that line so it says<br>
<tt>NotifyClamd /etc/clamd.conf</tt><br>
and you should find you still have a link in /etc/clamd.conf that
points to /etc/clamd.d/scan.conf.<br>
<br>
<br>
Delete everything in /var/lib/clamav totally. Just leave it as an
empty directory.<br>
Run the command<br>
<tt> freshclam</tt><br>
once. Ignore its final complaint about being unable to notify clamd.
That's because you can't start clamd until freshclam has fetched the
latest virus signatures for you.<br>
<br>
Then enable and start the services as follows:<br>
<tt> systemctl enable clamd@scan</tt><tt><br>
</tt><tt> systemctl enable clam-freshclam</tt><tt><br>
</tt><tt> systemctl start clamd@scan</tt><br>
<br>
And you should find the problem goes away again.<br>
<br>
If you have the time to report this to the ClamAV maintainers,
please do. No amount of Googling I did yesterday while fixing this
myself, produced anything useful. So I suspect they don't know yet.<br>
<br>
Cheers,<br>
Jules.<br>
<br>
<div class="moz-cite-prefix">On Tue 26/01/21 14:24, Anthony Wilson
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:WM!8428e144b94a38319d9c95f8986483f1432d9fa7241c6f0ebf25e878f211649ccca97b9dac5ff37506908df68b94b2d5!@mx.jul.es">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-US;}p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi Jules <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your response and apologies
for the delay with mine.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have cc’d the user, who will be able to
respond to the console task and file size.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please see below the space available<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">“Filesystem Size
Used Avail Use% Mounted on<o:p></o:p></p>
<p class="MsoNormal">devtmpfs 3.8G
0 3.8G 0% /dev<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 0 3.8G 0% /dev/shm<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 377M 3.5G 10% /run<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 0 3.8G 0% /sys/fs/cgroup<o:p></o:p></p>
<p class="MsoNormal">/dev/mapper/vg_root-lv_root 91G 4.3G
87G 5% /<o:p></o:p></p>
<p class="MsoNormal">/dev/mapper/dropoff-vol1 300G 9.3G
291G 4% /var/zendto/dropoffs<o:p></o:p></p>
<p class="MsoNormal">/dev/sda1 1014M
275M 740M 28% /boot<o:p></o:p></p>
<p class="MsoNormal">tmpfs
777M 0 777M 0% /run/user/0”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please see the error in the log file
similar to the initial issue.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">“zendto.log:2021-01-23 19:29:24
172.19.48.98 [ZendTo]: Error: Virus scan of dropped-off files
/var/zendto/incoming/eYzXdXMzGPtngj8o52brEmKoPjnF8e3d.1 for
awitney failed with
/var/zendto/incoming/eYzXdXMzGPtngj8o52brEmKoPjnF8e3d.1: Can't
allocate memory ERROR ----------- SCAN SUMMARY -----------
Infected files: 0 Total errors: 1 Time: 0.020 sec (0 m 0 s)
Start Date: 2021:01:23 19:29:24 End Date: 2021:01:23
19:29:24”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kind regards<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Anthony<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="mso-fareast-language:EN-GB" lang="EN-US">From:</span></b><span
style="mso-fareast-language:EN-GB" lang="EN-US"> Jules
<a class="moz-txt-link-rfc2396E" href="mailto:Jules@Zend.To"><Jules@Zend.To></a>
<br>
<b>Sent:</b> 19 January 2021 09:47<br>
<b>To:</b> Anthony Wilson <a class="moz-txt-link-rfc2396E" href="mailto:akwilson@sgul.ac.uk"><akwilson@sgul.ac.uk></a><br>
<b>Subject:</b> Re: Error Message When a User Drops of
6GB file.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Anthony,<br>
<br>
Can you ask him, when he gets these errors, to take a look in
the JavaScript console of his web browser and see if anything
is reported there? He basically needs to show the developer
console (right-clicking anywhere in the page and doing
"Inspect Element" is one of the most obvious ways), then click
on the "Console" tab and ensure it is showing "All" log
entries).<br>
<br>
Also, does your zendto.log report anything at this point?<br>
All the output from the virus checker will be logged in there.<br>
<br>
As it's a tar.gz file, how big is it when unpacked? Have you
got enough space in /var/zendto/incoming (and /var/zendto in
general), and /tmp for the virus scanner to unpack the
compressed archive? You might be simply running out of
temporary disk space that clamd needs.<br>
<br>
Hope that helps,<br>
Jules.<span style="mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">On Fri 08/01/21 13:58, Anthony Wilson
wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Support<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">We have a user (Adam) that is receiving a
misleading message when dropping of a file (see attached).
However the user has confirmed that the recipient
successfully received the files.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The process the user took is shown below<o:p></o:p></p>
<p class="MsoNormal">“Hi Anthony Details are 6Gb tar.gz file,
unencrypted, being uploaded from an NFS share through a
Desktop Windows 10 machine. Uploaded using Edge (not sure
the version, but it is the new Chome based one on my SGUL
machine) Thanks Adam”<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Please can you assist.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Kind regards<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Anthony
Wilson </span>
<o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Computing
Services </span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">St
Georges - University of London</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">Telephone:
+44 208 725 5435</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">email:
</span><a href="mailto:akwilson@sgul.ac.uk"
moz-do-not-send="true"><span
style="mso-fareast-language:EN-GB">akwilson@sgul.ac.uk</span></a><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB">website: </span><a
href="http://www.sgul.ac.uk/" moz-do-not-send="true"><span
style="mso-fareast-language:EN-GB">http://www.sgul.ac.uk/</span></a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="mso-fareast-language:EN-GB"><br>
<br>
<o:p></o:p></span></p>
<pre>Jules<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>The current UK shipping forecast:<o:p></o:p></pre>
<pre>Forties, Cromarty, Forth, Tyne: Southwest 4 to 6, becoming variable 3, then<o:p></o:p></pre>
<pre>cyclonic 4 to 6 later. Slight or moderate, occasionally rough in Forties.<o:p></o:p></pre>
<pre>Rain. Good, occasionally poor.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><a href="http://www.Zend.To" moz-do-not-send="true">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CEng CITP MBCS MIEEE MACM
'Is the Holocaust an aberration, or a reflection of who we really are?'
- Holocaust Museum, Berlin
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Twitter: @JulesFM
</pre>
</body>
</html>