<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 10 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>On the two servers that I admin which are running MailScanner
4.20-3, the “update_virus_scanners” script that runs hourly has been
causing issues since about 9:00 AM PST. The root cause appears to be that
“</span></font><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>ravav --update=engine” command is using taking way to
long and using a lot of CPU time, enough that MailScanner can’t keep up
it seems. By the time I noticed, there was several hundred messages in
the “mqueue.in” directory. I have disabled RAV for now, but I have
a couple questions:</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Has the “</span></font><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>update_virus_scanners” perhaps
been improved in recent versions perhaps to make it not so vulnerable to this
kind of thing? Perhaps external commands it calls could be “nice’d”
to some level that would not cause issue if they went awry? Did this
happen to anyone else?</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'> </span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>USER PID %CPU
%MEM VSZ RSS TTY STAT
START TIME COMMAND</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>root 13903 0.0 0.0
1432 444 ? S </span></font><font size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>13:01</span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
0:00 \_ CROND</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>root 13904 0.0
0.1 2048 956 ?
S </span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>13:01</span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
0:00 \_ /bin/bash /usr/bin/run-parts /etc/cron.hourly</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>root 13922 0.0
0.1 2044 968 ?
S </span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>13:01</span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
0:00 \_ /bin/bash /usr/sbin/update_virus_scanners</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>root 13958 0.0
0.2 3284 1448 ?
S </span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>13:01</span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
0:00 | \_ /usr/bin/perl
-w /usr/lib/MailScanner/rav-autoupdate</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>root 13959 84.0
0.1 1548 676 ?
R </span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>13:01</span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'>
</span></font><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>6:57</span></font><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'>
| \_ /usr/local/rav8//bin/ravav
--update=engine</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'> </span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'>Until now, MailScanner has been ultra-reliable for
months. Good job Julian!</span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span style='font-size:10.0pt;
font-family:"Courier New"'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Mickey</span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>SLP</span></font></p>
</div>
</body>
</html>