<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Hi Gavin,<br>
<br>
I forcibly installed ClamAV 0.102, then used the yum "versionlock"
plugin to ensure that they were never upgraded automatically.<br>
I'm still running 0.102 as a result.<br>
It sounds like the bug still exists in the most recent version.<br>
Have you got time to report it as a bug? I'm more than a little
surprised that they haven't noticed this one.<br>
<br>
BTW Changing the clamd.conf parameters for the maximum size of file
to scan (a few 100K I think) doesn't help at all. It's something to
do with how they mmap() the file. But I never had the time to find
exactly what was wrong, I had a broken production service to fix.<br>
<br>
Cheers,<br>
Jules.<br>
<br>
<div class="moz-cite-prefix">On Tue 20/04/21 11:58, Gavin Younger
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:WM!882abbeeca7bcc1277816b1d6e7544cc2d1f6cfe90652803804ba0d2ec855747795cc7028d85cc5ea8979dca96662900!@mx.jul.es">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:"Segoe UI Symbol";
panose-1:2 11 5 2 4 2 4 2 2 3;}@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
mso-fareast-language:EN-GB;}tt
{mso-style-priority:99;
font-family:"Courier New";}p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-GB;}span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-US;}span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Anthony, Jules,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">How did you get
on here? – seems I’ve hit the same problem here at Newcastle
(interestingly it was a 4GB cutoff rather than 6GB) – I
spent a fruitless afternoon adding more RAM and googling
too… (should have checked my mailing list messages first!)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Gavin Younger,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Infrastructure
Systems,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">IT Service
(NUIT),<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Newcastle
University<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="mso-fareast-language:EN-GB" lang="EN-US">From:</span></b><span
style="mso-fareast-language:EN-GB" lang="EN-US"> ZendTo
<a class="moz-txt-link-rfc2396E" href="mailto:zendto-bounces@zend.to"><zendto-bounces@zend.to></a>
<b>On Behalf Of </b>Jules via ZendTo<br>
<b>Sent:</b> 26 January 2021 14:43<br>
<b>To:</b> Anthony Wilson <a class="moz-txt-link-rfc2396E" href="mailto:akwilson@sgul.ac.uk"><akwilson@sgul.ac.uk></a><br>
<b>Cc:</b> Jules <a class="moz-txt-link-rfc2396E" href="mailto:Jules@Zend.To"><Jules@Zend.To></a>; Adam Witney
<a class="moz-txt-link-rfc2396E" href="mailto:awitney@sgul.ac.uk"><awitney@sgul.ac.uk></a>; ZendTo Users
<a class="moz-txt-link-rfc2396E" href="mailto:zendto@zend.to"><zendto@zend.to></a><br>
<b>Subject:</b> Re: [ZendTo] Error Message When a User
Drops of 6GB file. <<< ClamAV 0.103 bug<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid #E6E68A
4.5pt;padding:0cm 0cm 0cm 0cm;margin-bottom:3.75pt">
<p style="margin:0cm;margin-bottom:.0001pt;background:#FFFFCC"><span
style="font-family:"Segoe UI Symbol",sans-serif">⚠</span>
External sender. Take care when opening links or
attachments. Do not provide your login details.
<span style="mso-fareast-language:EN-GB"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Anthony,<br>
<br>
I have just hit the same problem on our installation of
ZendTo here at Southampton.<br>
<br>
I'm cc-ing this to the mailing list as it's going to become
a widespread problem.<br>
<br>
There's a bug in ClamAV 0.103.<br>
It crashes with a memory allocation failure if you try to
scan a file bigger than the available RAM in the server/VM.<br>
<br>
ClamAV 0.102 works fine.<br>
<br>
You can fetch the 0.102 RPMs from here:<br>
<a
href="https://archives.fedoraproject.org/pub/archive/epel/7/x86_64/Packages/c/"
moz-do-not-send="true" class="moz-txt-link-freetext">
https://archives.fedoraproject.org/pub/archive/epel/7/x86_64/Packages/c/</a><br>
<br>
Stop the services<br>
clamd@scan<br>
clam-freshclam<br>
clamav-freshclam<br>
Find all the clamAV RPMs you have installed:<br>
<tt><span style="font-size:10.0pt"> rpm -qa | grep -i
clam</span></tt><br>
Then use "rpm -e" to remote all of them in 1 command. That
stops dependency problems.<br>
<br>
Then fetch the 0.102 versions from the URL above: you want
to install these<br>
clamav<br>
clamav-filesystem<br>
clamav-lib<br>
clamav-update<br>
clamd<br>
Do *not* install "clamav-data".<br>
<br>
Edit /etc/clamd.d/scan.conf. There's a commented out line
mentioning "LocalSocket".<br>
Uncomment that line.<br>
<br>
Edit /etc/freshclam.conf. There's a commented out line
mentioning "NotifyClamd".<br>
Uncomment that line so it says<br>
<tt><span style="font-size:10.0pt">NotifyClamd
/etc/clamd.conf</span></tt><br>
and you should find you still have a link in /etc/clamd.conf
that points to /etc/clamd.d/scan.conf.<br>
<br>
<br>
Delete everything in /var/lib/clamav totally. Just leave it
as an empty directory.<br>
Run the command<br>
<tt><span style="font-size:10.0pt"> freshclam</span></tt><br>
once. Ignore its final complaint about being unable to
notify clamd. That's because you can't start clamd until
freshclam has fetched the latest virus signatures for you.<br>
<br>
Then enable and start the services as follows:<br>
<tt><span style="font-size:10.0pt"> systemctl enable
clamd@scan</span></tt><span
style="font-size:10.0pt;font-family:"Courier
New""><br>
<tt> systemctl enable clam-freshclam</tt><br>
<tt> systemctl start clamd@scan</tt></span><br>
<br>
And you should find the problem goes away again.<br>
<br>
If you have the time to report this to the ClamAV
maintainers, please do. No amount of Googling I did
yesterday while fixing this myself, produced anything
useful. So I suspect they don't know yet.<br>
<br>
Cheers,<br>
Jules.<span style="font-size:12.0pt;font-family:"Times
New Roman",serif"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">On Tue 26/01/21 14:24, Anthony Wilson
wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Jules <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thank you for your response and
apologies for the delay with mine.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I have cc’d the user, who will be able
to respond to the console task and file size.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Please see below the space available<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">“Filesystem Size
Used Avail Use% Mounted on<o:p></o:p></p>
<p class="MsoNormal">devtmpfs
3.8G 0 3.8G 0% /dev<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 0 3.8G 0% /dev/shm<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 377M 3.5G 10% /run<o:p></o:p></p>
<p class="MsoNormal">tmpfs
3.8G 0 3.8G 0% /sys/fs/cgroup<o:p></o:p></p>
<p class="MsoNormal">/dev/mapper/vg_root-lv_root 91G
4.3G 87G 5% /<o:p></o:p></p>
<p class="MsoNormal">/dev/mapper/dropoff-vol1 300G
9.3G 291G 4% /var/zendto/dropoffs<o:p></o:p></p>
<p class="MsoNormal">/dev/sda1
1014M 275M 740M 28% /boot<o:p></o:p></p>
<p class="MsoNormal">tmpfs
777M 0 777M 0% /run/user/0”<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Please see the error in the log file
similar to the initial issue.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">“zendto.log:2021-01-23 19:29:24
172.19.48.98 [ZendTo]: Error: Virus scan of dropped-off
files
/var/zendto/incoming/eYzXdXMzGPtngj8o52brEmKoPjnF8e3d.1
for awitney failed with
/var/zendto/incoming/eYzXdXMzGPtngj8o52brEmKoPjnF8e3d.1:
Can't allocate memory ERROR ----------- SCAN SUMMARY
----------- Infected files: 0 Total errors: 1 Time: 0.020
sec (0 m 0 s) Start Date: 2021:01:23 19:29:24 End Date:
2021:01:23 19:29:24”<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Kind regards<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Anthony<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="mso-fareast-language:EN-GB" lang="EN-US">From:</span></b><span
style="mso-fareast-language:EN-GB" lang="EN-US">
Jules
<a href="mailto:Jules@Zend.To"
moz-do-not-send="true"><Jules@Zend.To></a> <br>
<b>Sent:</b> 19 January 2021 09:47<br>
<b>To:</b> Anthony Wilson <a
href="mailto:akwilson@sgul.ac.uk"
moz-do-not-send="true"><akwilson@sgul.ac.uk></a><br>
<b>Subject:</b> Re: Error Message When a User Drops
of 6GB file.</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi
Anthony,<br>
<br>
Can you ask him, when he gets these errors, to take a look
in the JavaScript console of his web browser and see if
anything is reported there? He basically needs to show the
developer console (right-clicking anywhere in the page and
doing "Inspect Element" is one of the most obvious ways),
then click on the "Console" tab and ensure it is showing
"All" log entries).<br>
<br>
Also, does your zendto.log report anything at this point?<br>
All the output from the virus checker will be logged in
there.<br>
<br>
As it's a tar.gz file, how big is it when unpacked? Have
you got enough space in /var/zendto/incoming (and
/var/zendto in general), and /tmp for the virus scanner to
unpack the compressed archive? You might be simply running
out of temporary disk space that clamd needs.<br>
<br>
Hope that helps,<br>
Jules.<o:p></o:p></p>
<div>
<p class="MsoNormal">On Fri 08/01/21 13:58, Anthony Wilson
wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Support<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">We have a user (Adam) that is
receiving a misleading message when dropping of a file
(see attached). However the user has confirmed that the
recipient successfully received the files.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The process the user took is shown
below<o:p></o:p></p>
<p class="MsoNormal">“Hi Anthony Details are 6Gb tar.gz
file, unencrypted, being uploaded from an NFS share
through a Desktop Windows 10 machine. Uploaded using
Edge (not sure the version, but it is the new Chome
based one on my SGUL machine) Thanks Adam”<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Please can you assist.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Kind regards<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">Anthony Wilson </span>
<o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">Computing Services </span><o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">St Georges -
University of London</span><o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">Telephone: +44 208
725 5435</span><o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">email: </span><a
href="mailto:akwilson@sgul.ac.uk"
moz-do-not-send="true"><span
style="mso-fareast-language:EN-GB">akwilson@sgul.ac.uk</span></a><o:p></o:p></p>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB">website: </span><a
href="http://www.sgul.ac.uk/" moz-do-not-send="true"><span
style="mso-fareast-language:EN-GB">http://www.sgul.ac.uk/</span></a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span
style="mso-fareast-language:EN-GB"><br>
<br>
<br>
</span><o:p></o:p></p>
<pre>Jules<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>The current UK shipping forecast:<o:p></o:p></pre>
<pre>Forties, Cromarty, Forth, Tyne: Southwest 4 to 6, becoming variable 3, then<o:p></o:p></pre>
<pre>cyclonic 4 to 6 later. Slight or moderate, occasionally rough in Forties.<o:p></o:p></pre>
<pre>Rain. Good, occasionally poor.<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre><a href="http://www.Zend.To" moz-do-not-send="true">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman",serif;mso-fareast-language:EN-GB"><br>
<br>
<o:p></o:p></span></p>
<pre>Jules<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>'Is the Holocaust an aberration, or a reflection of who we really are?'<o:p></o:p></pre>
<pre> - Holocaust Museum, Berlin<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><a href="http://www.Zend.To" moz-do-not-send="true">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CEng CITP MBCS MIEEE MACM
'It's very unlikely indeed he will ever recover consciousness, and
if he does he won't be the Julian you knew.'
- A hospital consultant I proved very wrong in 2007 :-)
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Twitter: @JulesFM
</pre>
</body>
</html>