Re: Trophie worker processes dying at a high rate: am I alone?

Hello Craig,

On Wed, Aug 18, 2004 at 12:13:03PM +1000, [email protected] wrote:
> Hi Alian,

Alain, thanks :-)

> 
> You are not alone, we experienced this as well, however I found that 
> things got a whole lot better when I updated the vsapi version to the one 
> which handles the longer version format. There is an update package on 
> trends download site. (for almost any of the Linux products it is the same 
> download)

Well, I had using  the  latest  libvsapi.so  for  a  while  when  this
happened. Since it's a  shared  library  I  can't  see  how  relinking
trophie with this library would do something either, but I'll give  it
a try anyway if I get hit again.

> 
> I will keep an eye on it for all. 
> 

I've  written a quick-and-dirty shell script that monitors the maillog
for those infamous "trophie: ... SIGNAL[11]..." errors and restarts it
if  they  show  up,  or  disable  Trophie  altogether in amavisd-new's
configuration  file  after  3 consecutive occurences. So far it's been
quiet.

> I have a general question (slightly off topic but related) about bringing 
> the whole thing together. I am getting conflicting information about how 
> to update Trend's scanner. 
> 
> Should I be using tupdate.pl or the SPLX automatic updater?

I'm not familiar with tupdate.pl. It doesn't seem to be a rename of my
own trend-update.pl (the messages you quote below do not match). Where
did you get it from?


> (we have 
> licensed the SPLX product,

So  have  we. My experience with the SPLX auto update is that is works
OK,  but  will  not get you the CPRs. Also it's too quiet and doesn't
manage Trophie and putting the patterns at the right place for Trophie
to find them. Also, does it update libvsapi.so? not sure.

All this is why I enventually decided to whip up my own update script.

> however we run new kernels and cannot use the 
> web interface because there are no Trend supported modules for the current 
> kernels. (is there a way to force these modules to load on a newer kernel 
> without risk of blowing everything up?

Not that I know of. I've tried various things on a sandbox machine and
got only trouble. Anyway I didn't need the web interface or  the  scan
on access feature for my mail gateway so I gave up.
SPLX is not the right product for a mail gateway. You want ISCAN.
Don't  know  if  Trend has a way to license only the scanning API like
Sophos has, because that's what you really want for a mail box with Trophie.

> 
> The tupdate script appears to keep updating even though the update has 
> occurred. 
> 
> It would appear that something is wrong with dealing with the new version 
> numbering. 
> 
> Has anyone got a patch for this (or a newer version of tupdate.pl) ?

Well, I have my own trend-update.pl which I'm in the process of fixing
for the new numbering scheme. It works for now,  but  there's  a  very
high  chance  that it will break again at patterns 960 and 980. So I'm
waiting  for  this  to  happen and come up with a really fixed version
until I put it on my web  server.  Unless  I  have  missed  something,
there's not enough public information provided by Trend now for me  to
fix it now (what will the new lptXXX.zip files be called?).

> I have my amavis-new using vscan as a secondary with clam just in case 
> trophie drops out. If you use vscan -v you can check the version of the 
> APIs easier than looking through the maillogs for the trophie output. 

I also have vscan as a secondary,  but  due  to  the  amount  of  mail
traffic on my gateway, it really can't manage  it  when  using  a  CLI
scanner and the mail queue grows until my phone
rings :-)

BTW is vscan part of SPLX? Wasn't installed here.

> *** and here is the output of tupdate.pl --debug for the more 
> comprehensive information.
> 
> ./tupdate.pl --debug
> <-** running in debug mode **->
> current version = 958
> current version = 1.958.00
> local_version is 1.958.00
> local file is not present!
> running request
> url=ftp://pattern.download.antivirus.com/products/pattern/lpt958.zip
> member=lpt$vpn.958
> member=whatsnew.txt
> 
> *** and I recieve emails with the following subject:
> V-DEF UPDATE (1.958.00 -> 958) on xxx.xxx.xxx.xxx
> 
> even though it has the correct version.

Would  love  to  see  that  script.  Google  didn't provide any hit on
tupdate.pl.

Greets,
_Alain_