Thank you guys! If it would be so easy..: *** root@server:~# df -h Filesystem Size Used Avail Use% Mounted on /dev/xvda 9.7G 1.9G 7.8G 19% / tmpfs 338M 0 338M 0% /lib/init/rw udev 10M 112K 9.9M 2% /dev tmpfs 338M 0 338M 0% /dev/shm
*** and *** 273635 drwxrwxrwx 2 root root 4096 Jan 20 06:53 clamav-tmp It's default Ubuntu server at linode so no restrictions were set as far as I know. And since clamd is running under root I can't imagine any restrictions for root in filesystem access. So, it's probably something else. Looks like file size restriction was set somewhere, but I have no idea (checked everywhere incl. php.ini, nginx.conf, clamd.conf). All file size related configuration strings were increased simple by multiplying values to their maximum. Only fact I have is that ZIP file under 50M passes clamav tests, and ZIP which is more than 50M fails. 2013/1/20 Greg Folkert <g...@donor.com>: > Answered down below. > On Sun, 2013-01-20 at 13:34 +0100, A A wrote: >> Hi, >> >> I have clamd daemon 0.97.6 (OS: linux-gnu, ARCH: i386, CPU: i486), >> nginx as webserver and php front-end for files upload. When ZIP >> archive file more than ~50Mb is being uloaded, Clamav gives an error >> "ERROR: INSTREAM: Can't write to temporary file." All possible limits >> were increased: > [SNIP] >> got command INSTREAM (9, 14), argument: >> Receive thread: INSTREAM: >> /clamav-tmp/clamav-8562bac6363939841a94b960e1a168df fd 11 >> Breaking command loop, mode is no longer MODE_COMMAND >> Moved partial command: 4094 >> mode == MODE_STREAM >> Got chunksize: 103826982 >> Quota: 4191140313 >> Processed 4090 bytes of chunkdata >> Received POLLIN|POLLHUP on fd 10 >> Moved partial command: 4104 >> mode == MODE_STREAM > [SNIP] >> ERROR: INSTREAM: Can't write to temporary file. >> Processed 4104 bytes of chunkdata >> Shutting down socket after error (FD 10) >> Number of file descriptors polled: 1 fds >> fds_poll_recv: timeout after 3600 seconds > > I'm going to ask the first and most simple questions: > > Is the file-system that "/clamav-tmp" almost full? Or limited in > writing... or not writable by the user the clamav daemon is running as? > > In other words these: > 1) If the (apparently /) file-system has limited space available > (available space - reserved space) greater than or more than the > "EXPANDED" size of the file? > > 2) Is the file-system limited to "non-temporary" usage, either by user > settings or security policy? > > 3) Is the "/clamav-tmp" directory writable by the clamav-user? > > If you can answer those three questions... you should have just answered > your plea for help yourself. > > Cheers! > -- > greg folkert - systems administration and support > web: donor.com > email: g...@donor.com > phone: 877-751-3300 x416 > direct: 616-328-6449 (direct dial and fax) > "I beg you take courage; the brave soul can mend even disaster." > -- Catherine II > > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
