uvscan does not go away

[Denis Beauchemin]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kai Wang wrote:

> Hi,
>
> I found recently that there are some McAfee uvscan process chewing the 
> mail
> server cpu. MailScanner was the one that started the process. The 
> directory,
> which MailScanner started the process, disappeared already. But the 
> uvscan
> process just does not go.
>

Kai,

It usually happens when I reload MS while MS is virus scanning some 
email.  The uvscan just stays there and consumes CPU.

I call the included script in root's crontab:
0-59/5 * * * * /usr/local/bin/killOldUvscan

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

#!/usr/bin/perl -w
#
# Script to kill old uvscan processes that are hung.
#
# $Id: killOldUvscan,v 1.4 2004/04/26 20:09:39 bead2306 Exp $
#
# $Log: killOldUvscan,v $
# Revision 1.4  2004/04/26 20:09:39  bead2306
# Added safety for beginning of the day (near midnight).
#
# Revision 1.3  2004/03/17 18:39:18  bead2306
# Added output when a process is terminated.
#
# Revision 1.2  2004/03/17 02:08:44  bead2306
# Added code to be more verbose.
#
# Revision 1.1  2004/03/17 01:08:06  bead2306
# Initial release.
#

my $optDebug = 0;
my $PROCESS = "uvscan";
my $MAX_AGE = 10; # minutes
#my $MAX_AGE = 2; # minutes
my $MIN_AGE = 20 ; # minutes

my $ps = `/bin/ps -efww | grep $PROCESS | grep -v grep`;

foreach my $process ( split( '\n', $ps ) ){
    print "Process: $process\n" if ( $optDebug );
    my $time = ( split( '\s+', $process ) )[4];
    my $currentTime = now();
    if ( $time =~ /^(\d+):(\d+)$/ ){
        my $minutes = $1 * 60 + $2;
        if ( $currentTime - $minutes > $MAX_AGE ){
            # Bingo!
            killProcess( $process );
        } elsif ( ($currentTime < $minutes) && ( ($currentTime + 24 * 60) - $minutes > $MAX_AGE) ){
            # Bingo!
            killProcess( $process );
        } else {
            # Have to wait a little more...
            print "-- Current: $currentTime, Time: $minutes, $MAX_AGE\n" if ( $optDebug );
        }
    } elsif ( $time =~ /^[A-Z][a-z]{2}\d{2}$/ ){
        # Bingo! time is so old it is now a date!
        killProcess( $process ) if ( $currentTime > $MIN_AGE );
    } else {
        print "Should not happen! $time\n" if ( $optDebug );
    }
}

sub killProcess{
    my( $ps ) = @_;

    $ps =~ /^\w+\s+(\d+)\s+/;
    if ( defined( $1 ) ){
        my $process = $1;
        print "kill $ps\n";
        return kill 15, $process;
        #system( "/bin/kill $process" );
    } else {
        print "No process ID: $ps\n";
        return 0;
    }
}

sub now{
    my( $sec, $min, $hour, $mday, $month, $year ) = localtime( );

    return $hour * 60 + $min;
}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).