RAV autoupdate script causing issues today

[Mickey Everts]

On the two servers that I admin which are running MailScanner 4.20-3,
the "update_virus_scanners" script that runs hourly has been causing
issues since about 9:00 AM PST.  The root cause appears to be that
"ravav --update=engine" command is using taking way to long and using a
lot of CPU time, enough that MailScanner can't keep up it seems.  By the
time I noticed, there was several hundred messages in the "mqueue.in"
directory. I have disabled RAV for now, but I have a couple questions:



Has the "update_virus_scanners" perhaps been improved in recent versions
perhaps to make it not so vulnerable to this kind of thing?  Perhaps
external commands it calls could be "nice'd" to some level that would
not cause issue if they went awry?  Did this happen to anyone else?



USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND

root     13903  0.0  0.0  1432  444 ?        S    13:01   0:00  \_ CROND

root     13904  0.0  0.1  2048  956 ?        S    13:01   0:00      \_
/bin/bash /usr/bin/run-parts /etc/cron.hourly

root     13922  0.0  0.1  2044  968 ?        S    13:01   0:00
\_ /bin/bash /usr/sbin/update_virus_scanners

root     13958  0.0  0.2  3284 1448 ?        S    13:01   0:00
|   \_ /usr/bin/perl -w /usr/lib/MailScanner/rav-autoupdate

root     13959 84.0  0.1  1548  676 ?        R    13:01   6:57
|       \_ /usr/local/rav8//bin/ravav --update=engine



Until now, MailScanner has been ultra-reliable for months.  Good job
Julian!



Mickey

SLP

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030930/9f2e8fdc/attachment.html