The sytanx should be: clamscan --max-filesiz=#n
Below is the exerpt from the man file: --max-filesize=#n Extract and scan at most #n kilobytes from each archive. You may pass the value in megabyte in format xM or xm, where x is a number. This option protects your system against DoS attacks (default: 25 MB) Again on either side, clamscan or clamdscan, it should say something that a file was not scanned for any reason. Here is a sample message if the file was too large: The file "the file name" is too large to be scanned. Please consider increasing max-filesize setting. Please read http://lurker.clamav.net/message/20080313.165458.ac80f65a.en.html (or some other warning about DoS and other information about increasing max-filesize). I get these messages from spamassassin running out of child processes and I used that as my sample for this type of message. Frank >On 9/22/08, Eric Rostetter <[EMAIL PROTECTED]> wrote: >> Quoting fchan <[EMAIL PROTECTED]>: >> >> > Remember not everyone that uses clamav is not an expert so for >> >> >> They don't have to be an expert, they just have to read and configure >> the configuration file for their needs. >> >> >> > someone that is new to clamav thinks that every file that went >> > through clamav would be scanned for malware would be incorrect and >> > they have a possibility of opening an infected file. I think a >> >> >> Yes, but they should have read the configuration file, and change it >> to meet their needs. If they didn't, well, that is their fault. >> >> >> > message or warning that a file that was too large passed through >> > clamav without being scanned would be nice so one can take >> > appropriate action. That is my opinion. >> >> >> First, it is not too large to pass through clamav, the user decided >> they didn't want it to pass through, or the user was negligent in >> configuring it. > >I'm using clamscan directly not clamdscan.... > >How can I change the default behavior without have to specify >--max-filesize parameter at command line ? > >> >> Second, I would support such an output only when using the scanner >> in "debug" mode... Would be very useful when debugging, to see such >> a message. In normal mode, I see no reason to force this on the author >> against their will. Even in debug mode, it is up to the author, but >> I do think it would be useful in debug mode... >_______________________________________________ >Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net >http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
