RAV autoupdate script causing issues today

[Craig Pratt]

Yup - seeing the same thing. If I run it manually, it just hangs at
"Make remote list of files..."

/usr/local/rav8/bin/ravav --update=engine

RAV AntiVirus command line for Linux i686.
Version: 8.3.1.
Copyright (c) 1996-2001 GeCAD The Software Company. All rights reserved.
Start updating... Tue Sep 30 22:26:21 2003
Opening a socket        ...done!
Looking for: ftp.us.ravantivirus.com    ...done!
Connecting to server: ftp.us.ravantivirus.com   ...done!
User login ...
Password authentification ...
Chdir remote... /pub/rav/update/rave
Make remote list of files...

I seem to remember there being a setting for how often MS will run the
autoupdate script. But I don't seem to be able to find it.

Are their servers being DOSes - either maliciously or by engine updates
perhaps?

Craig

On Tuesday, Sep 30, 2003, at 14:56 US/Pacific, Dan Williamson wrote:
> I'm having the same problem as well.
> 4 of my servers locked, queuing several thousand emails before the
> calls
> started to come in.
>
> I just recently upgraded all servers to 4.23-11.
> I am killing all ravav processes on the hour and restarting
> MailScanner.
>
> regards,
> -dan
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf
> Of Mickey Everts
> Sent: Tuesday, September 30, 2003 3:34 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: RAV autoupdate script causing issues today
>
>
>
> On the two servers that I admin which are running MailScanner 4.20-3,
> the
> "update_virus_scanners" script that runs hourly has been causing issues
> since about 9:00 AM PST.  The root cause appears to be that
> "ravav --update=engine" command is using taking way to long and using
> a lot
> of CPU time, enough that MailScanner can't keep up it seems.  By the
> time I
> noticed, there was several hundred messages in the "mqueue.in"
> directory. I
> have disabled RAV for now, but I have a couple questions:
>
> Has the "update_virus_scanners" perhaps been improved in recent
> versions
> perhaps to make it not so vulnerable to this kind of thing?  Perhaps
> external commands it calls could be "nice'd" to some level that would
> not
> cause issue if they went awry?  Did this happen to anyone else?
>
> USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
> root     13903  0.0  0.0  1432  444 ?        S    13:01   0:00  \_
> CROND
> root     13904  0.0  0.1  2048  956 ?        S    13:01   0:00      \_
> /bin/bash /usr/bin/run-parts /etc/cron.hourly
> root     13922  0.0  0.1  2044  968 ?        S    13:01   0:00
>  \_
> /bin/bash /usr/sbin/update_virus_scanners
> root     13958  0.0  0.2  3284 1448 ?        S    13:01   0:00
>  |
> \_ /usr/bin/perl -w /usr/lib/MailScanner/rav-autoupdate
> root     13959 84.0  0.1  1548  676 ?        R    13:01   6:57
>  |
> \_ /usr/local/rav8//bin/ravav --update=engine
>
> Until now, MailScanner has been ultra-reliable for months.  Good job
> Julian!
>
> Mickey
> SLP
>
> --
> This message checked for dangerous content by MailScanner on StrongBox.
>
>
---
Craig Pratt
Strongbox Network Services Inc.
mailto:craig at strong-box.net
dtmf:503.706.2933


--
This message checked for dangerous content by MailScanner on StrongBox.