RAV autoupdate script causing issues today

[Craig Pratt]

On Tuesday, Sep 30, 2003, at 22:37 US/Pacific, Craig Pratt wrote:
> Yup - seeing the same thing. If I run it manually, it just hangs at
> "Make remote list of files..."
>
> /usr/local/rav8/bin/ravav --update=engine
>
> RAV AntiVirus command line for Linux i686.
> Version: 8.3.1.
> Copyright (c) 1996-2001 GeCAD The Software Company. All rights
> reserved.
> Start updating... Tue Sep 30 22:26:21 2003
> Opening a socket        ...done!
> Looking for: ftp.us.ravantivirus.com    ...done!
> Connecting to server: ftp.us.ravantivirus.com   ...done!
> User login ...
> Password authentification ...
> Chdir remote... /pub/rav/update/rave
> Make remote list of files...
>
> I seem to remember there being a setting for how often MS will run the
> autoupdate script. But I don't seem to be able to find it.

DOH - of course, it's cron that's running it.

I *think* what's happening is:

(1) update script is run by cron
(2) Update script grabs the update lock,
(3) RAV update stalls (looks like the FTP server has fallen down and
RAV's update function busy-waits - caught mine using 98% of CPU)
(4) MailScanner stalls waiting for the lock (last log entry is
"MailScanner[10669]: Virus and Content Scanning: Starting").
(5) check_MailScanner doesn't detect the condition since the process is
running - just blocked

Note that I'm running MS 4.12-2.

Temporary solution for me:  mv /etc/cron.hourly/update_virus_scanners
/etc/cron.daily/

Running ftp manually to either ftp.us.ravantivirus.com or
ftp.ravantivirus.com seems to demonstrate that their servers are hosed.
Don't know why.

Craig

> On Tuesday, Sep 30, 2003, at 14:56 US/Pacific, Dan Williamson wrote:
>> I'm having the same problem as well.
>> 4 of my servers locked, queuing several thousand emails before the
>> calls
>> started to come in.
>>
>> I just recently upgraded all servers to 4.23-11.
>> I am killing all ravav processes on the hour and restarting
>> MailScanner.
>>
>> regards,
>> -dan
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
>> Behalf
>> Of Mickey Everts
>> Sent: Tuesday, September 30, 2003 3:34 PM
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: RAV autoupdate script causing issues today
>>
>>
>>
>> On the two servers that I admin which are running MailScanner 4.20-3,
>> the
>> "update_virus_scanners" script that runs hourly has been causing
>> issues
>> since about 9:00 AM PST.  The root cause appears to be that
>> "ravav --update=engine" command is using taking way to long and using
>> a lot
>> of CPU time, enough that MailScanner can't keep up it seems.  By the
>> time I
>> noticed, there was several hundred messages in the "mqueue.in"
>> directory. I
>> have disabled RAV for now, but I have a couple questions:
>>
>> Has the "update_virus_scanners" perhaps been improved in recent
>> versions
>> perhaps to make it not so vulnerable to this kind of thing?  Perhaps
>> external commands it calls could be "nice'd" to some level that would
>> not
>> cause issue if they went awry?  Did this happen to anyone else?
>>
>> USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
>> root     13903  0.0  0.0  1432  444 ?        S    13:01   0:00  \_
>> CROND
>> root     13904  0.0  0.1  2048  956 ?        S    13:01   0:00      \_
>> /bin/bash /usr/bin/run-parts /etc/cron.hourly
>> root     13922  0.0  0.1  2044  968 ?        S    13:01   0:00
>>  \_
>> /bin/bash /usr/sbin/update_virus_scanners
>> root     13958  0.0  0.2  3284 1448 ?        S    13:01   0:00
>>  |
>> \_ /usr/bin/perl -w /usr/lib/MailScanner/rav-autoupdate
>> root     13959 84.0  0.1  1548  676 ?        R    13:01   6:57
>>  |
>> \_ /usr/local/rav8//bin/ravav --update=engine
>>
>> Until now, MailScanner has been ultra-reliable for months.  Good job
>> Julian!
>>
>> Mickey
>> SLP


--
This message checked for dangerous content by MailScanner on StrongBox.