Virus update times

[Michael Janssen]

On Mon, 1 Mar 2004, Spicer, Kevin wrote:

> Julian Field wrote:
>
> > 2nd thoughts. I am going to make the random delay 10 minutes for now
> > as I still want people to basically get updates every hour.
> >
> I wonder whether just pulling the 'inode modification time' (ls -lc)
> of update_virus_scanners and using the minutes & seconds from that to
> create a delay would be acceptable.  That way the update would be
> every hour, but at the same (semi-random) time every hour.

This way you also know when protection came in without examinig the logs
(given that you know the hour by notifications or dramatical increase of
found virusses ;-). But I don't like to use the ctime. When you happen
to have more than one mailscanner server, you will have different update
times between servers, which might make the things complicate to track.

I would use the domainname to create a semi-random number and the
machines update at the same time within this domain. Unfurtunately, I
don't know how to do it in perl. Shell could be:

NUMERICAL_VALUE=`domainname | md5sum | \
 od --address-radix=n --read-bytes 4 --format d4`
DELAY=$(( NUMERICAL_VALUE % 3600 ))


but this has to many assumption on installed programms (domainname is to
much of a assumption).

Can someone suggest how to compute the domainname with perl and turn it
into a relatively random number then do "% 3600" and sleep about?


Michael