RAV autoupdate script causing issues today

[Craig Pratt]

On Wednesday, Oct 1, 2003, at 01:46 US/Pacific, Julian Field wrote:
> Try this.
>
> It will time out after 5 minutes.

Thanks Julian - I'll try this out.

Of course, whatever was going on yesterday has been resolved. So I
can't really test it. But it'll still be a good addition.

It's strange behavior for an update routine to do something like this
(busy-wait instead of outright failing). But the timer is probably a
good safety net.

C

> At 08:43 01/10/2003, you wrote:
>> On Tuesday, Sep 30, 2003, at 22:37 US/Pacific, Craig Pratt wrote:
>>> Yup - seeing the same thing. If I run it manually, it just hangs at
>>> "Make remote list of files..."
>>>
>>> /usr/local/rav8/bin/ravav --update=engine
>>>
>>> RAV AntiVirus command line for Linux i686.
>>> Version: 8.3.1.
>>> Copyright (c) 1996-2001 GeCAD The Software Company. All rights
>>> reserved.
>>> Start updating... Tue Sep 30 22:26:21 2003
>>> Opening a socket        ...done!
>>> Looking for: ftp.us.ravantivirus.com    ...done!
>>> Connecting to server: ftp.us.ravantivirus.com   ...done!
>>> User login ...
>>> Password authentification ...
>>> Chdir remote... /pub/rav/update/rave
>>> Make remote list of files...
>>>
>>> I seem to remember there being a setting for how often MS will run
>>> the
>>> autoupdate script. But I don't seem to be able to find it.
>>
>> DOH - of course, it's cron that's running it.
>>
>> I *think* what's happening is:
>>
>> (1) update script is run by cron
>> (2) Update script grabs the update lock,
>> (3) RAV update stalls (looks like the FTP server has fallen down and
>> RAV's update function busy-waits - caught mine using 98% of CPU)
>> (4) MailScanner stalls waiting for the lock (last log entry is
>> "MailScanner[10669]: Virus and Content Scanning: Starting").
>> (5) check_MailScanner doesn't detect the condition since the process
>> is
>> running - just blocked
>>
>> Note that I'm running MS 4.12-2.
>>
>> Temporary solution for me:  mv /etc/cron.hourly/update_virus_scanners
>> /etc/cron.daily/
>>
>> Running ftp manually to either ftp.us.ravantivirus.com or
>> ftp.ravantivirus.com seems to demonstrate that their servers are
>> hosed.
>> Don't know why.
>>
>> Craig
>>
>>> On Tuesday, Sep 30, 2003, at 14:56 US/Pacific, Dan Williamson wrote:
>>>> I'm having the same problem as well.
>>>> 4 of my servers locked, queuing several thousand emails before the
>>>> calls
>>>> started to come in.
>>>>
>>>> I just recently upgraded all servers to 4.23-11.
>>>> I am killing all ravav processes on the hour and restarting
>>>> MailScanner.
>>>>
>>>> regards,
>>>> -dan
>>>>
>>>> -----Original Message-----
>>>> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
>>>> Behalf
>>>> Of Mickey Everts
>>>> Sent: Tuesday, September 30, 2003 3:34 PM
>>>> To: MAILSCANNER at JISCMAIL.AC.UK
>>>> Subject: RAV autoupdate script causing issues today
>>>>
>>>>
>>>>
>>>> On the two servers that I admin which are running MailScanner
>>>> 4.20-3,
>>>> the
>>>> "update_virus_scanners" script that runs hourly has been causing
>>>> issues
>>>> since about 9:00 AM PST.  The root cause appears to be that
>>>> "ravav --update=engine" command is using taking way to long and
>>>> using
>>>> a lot
>>>> of CPU time, enough that MailScanner can't keep up it seems.  By the
>>>> time I
>>>> noticed, there was several hundred messages in the "mqueue.in"
>>>> directory. I
>>>> have disabled RAV for now, but I have a couple questions:
>>>>
>>>> Has the "update_virus_scanners" perhaps been improved in recent
>>>> versions
>>>> perhaps to make it not so vulnerable to this kind of thing?  Perhaps
>>>> external commands it calls could be "nice'd" to some level that
>>>> would
>>>> not
>>>> cause issue if they went awry?  Did this happen to anyone else?
>>>>
>>>> USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME
>>>> COMMAND
>>>> root     13903  0.0  0.0  1432  444 ?        S    13:01   0:00  \_
>>>> CROND
>>>> root     13904  0.0  0.1  2048  956 ?        S    13:01   0:00
>>>> \_
>>>> /bin/bash /usr/bin/run-parts /etc/cron.hourly
>>>> root     13922  0.0  0.1  2044  968 ?        S    13:01   0:00
>>>>  \_
>>>> /bin/bash /usr/sbin/update_virus_scanners
>>>> root     13958  0.0  0.2  3284 1448 ?        S    13:01   0:00
>>>>  |
>>>> \_ /usr/bin/perl -w /usr/lib/MailScanner/rav-autoupdate
>>>> root     13959 84.0  0.1  1548  676 ?        R    13:01   6:57
>>>>  |
>>>> \_ /usr/local/rav8//bin/ravav --update=engine
>>>>
>>>> Until now, MailScanner has been ultra-reliable for months.  Good job
>>>> Julian!
>>>>
>>>> Mickey
>>>> SLP


--
This message checked for dangerous content by MailScanner on StrongBox.