Fwd: Re: Trophie worker processes dying at a high rate: am I alone?

----- Forwarded message from [email protected] -----

X-Original-To: [email protected]
Delivered-To: [email protected]
In-Reply-To: <[email protected]>
To: Alain Fauconnet <[email protected]>
Cc: [email protected]
Subject: Re: Trophie worker processes dying at a high rate: am I alone?
X-Mailer: Lotus Notes Release 6.0 September 26, 2002
From: [email protected]
Date: Fri, 20 Aug 2004 10:12:33 +1000
X-MIMETrack: Serialize by Router on SydneyMail/Remex/AU(Release 6.5|September 26, 2003) at
 20/08/2004 10:12:29 AM,
	Serialize complete at 20/08/2004 10:12:29 AM
X-Virus-Scanned: by amavisd-new at exl.com.au
X-Virus-Scanned: by amavisd-new at mail-gate.ait.ac.th
X-Virus-Scanned: by amavisd-new at mailserv.ait.ac.th
X-Sanitizer: This message has been sanitized by AIT MailServer!
X-Sanitizer-URL: http://intraweb.ait.ac.th/helpdesk/Announcement.html#1
X-Sanitizer-Rev: $Id: Sanitizer.pm,v 1.54 2002/02/15 16:59:07 bre Exp $

Sorry about the name typo Alain (woops)

I was silly and didn't write down it's heritage when I found it. However 
doing a google on the id line in the code shows that it can be found at:
http://www.amavis.org/contrib/update-virus-def.pl 
and I think it is the same one. (haven't gone through the code with a fine 
tooth comb yet) - If you need a copy of the one I have, yell out. I may 
even set up a web site to host it.

As you probably know, you can get vscan by looking in the free download 
area on the trend site. I understand that, in order to use it this way 
(downloaded for free), it must be non-commercial use, however if you order 
the media kit, it is on the Linux CD. You need to decompress one of the 
programs there - one might assume that if you purchased the scanner 
product, and the media kit, then it follows that the old command line 
scanner is licensed as well (no liability accepted from me though ;-)

If you want, I can look where it is on the CD for you. I am a little busy 
for the next few days and I will see what I can do.

May I have a copy of your update script?

Thanks

Craig
PS: Could you forward this message to the list if it doesn't get there. I 
may have forgotten which outbound address I registered with.


Alain Fauconnet <[email protected]> wrote on 18/08/2004 12:35:10 PM:

> Hello Craig,

> On Wed, Aug 18, 2004 at 12:13:03PM +1000, [email protected] 
wrote:
> > Hi Alian,

> Alain, thanks :-)

> >
> > You are not alone, we experienced this as well, however I found that
> > things got a whole lot better when I updated the vsapi version to the 
one
> > which handles the longer version format. There is an update package on
> > trends download site. (for almost any of the Linux products it is the 
same
> > download)

> Well, I had using  the  latest  libvsapi.so  for  a  while  when  this
> happened. Since it's a  shared  library  I  can't  see  how  relinking
> trophie with this library would do something either, but I'll give  it
> a try anyway if I get hit again.

> >
> > I will keep an eye on it for all.
> >

> I've  written a quick-and-dirty shell script that monitors the maillog
> for those infamous "trophie: ... SIGNAL[11]..." errors and restarts it
> if  they  show  up,  or  disable  Trophie  altogether in amavisd-new's
> configuration  file  after  3 consecutive occurences. So far it's been
> quiet.

> > I have a general question (slightly off topic but related) about 
bringing
> > the whole thing together. I am getting conflicting information about 
how
> > to update Trend's scanner.
> >
> > Should I be using tupdate.pl or the SPLX automatic updater?

> I'm not familiar with tupdate.pl. It doesn't seem to be a rename of my
> own trend-update.pl (the messages you quote below do not match). Where
> did you get it from?

> 
> > (we have
> > licensed the SPLX product,

> So  have  we. My experience with the SPLX auto update is that is works
> OK,  but  will  not get you the CPRs. Also it's too quiet and doesn't
> manage Trophie and putting the patterns at the right place for Trophie
> to find them. Also, does it update libvsapi.so? not sure.

> All this is why I enventually decided to whip up my own update script.

> > however we run new kernels and cannot use the
> > web interface because there are no Trend supported modules for the 
current
> > kernels. (is there a way to force these modules to load on a newer 
kernel
> > without risk of blowing everything up?

> Not that I know of. I've tried various things on a sandbox machine and
> got only trouble. Anyway I didn't need the web interface or  the  scan
> on access feature for my mail gateway so I gave up.
> SPLX is not the right product for a mail gateway. You want ISCAN.
> Don't  know  if  Trend has a way to license only the scanning API like
> Sophos has, because that's what you really want for a mail box with 
Trophie.

> >
> > The tupdate script appears to keep updating even though the update has
> > occurred.
> >
> > It would appear that something is wrong with dealing with the new 
version
> > numbering.
> >
> > Has anyone got a patch for this (or a newer version of tupdate.pl) ?

> Well, I have my own trend-update.pl which I'm in the process of fixing
> for the new numbering scheme. It works for now,  but  there's  a  very
> high  chance  that it will break again at patterns 960 and 980. So I'm
> waiting  for  this  to  happen and come up with a really fixed version
> until I put it on my web  server.  Unless  I  have  missed  something,
> there's not enough public information provided by Trend now for me  to
> fix it now (what will the new lptXXX.zip files be called?).

> > I have my amavis-new using vscan as a secondary with clam just in case
> > trophie drops out. If you use vscan -v you can check the version of 
the
> > APIs easier than looking through the maillogs for the trophie output.

> I also have vscan as a secondary,  but  due  to  the  amount  of  mail
> traffic on my gateway, it really can't manage  it  when  using  a  CLI
> scanner and the mail queue grows until my phone
> rings :-)

> BTW is vscan part of SPLX? Wasn't installed here.

> > *** and here is the output of tupdate.pl --debug for the more
> > comprehensive information.
> >
> > ./tupdate.pl --debug
> > <-** running in debug mode **->
> > current version = 958
> > current version = 1.958.00
> > local_version is 1.958.00
> > local file is not present!
> > running request
> > url=ftp://pattern.download.antivirus.com/products/pattern/lpt958.zip
> > member=lpt$vpn.958
> > member=whatsnew.txt
> >
> > *** and I recieve emails with the following subject:
> > V-DEF UPDATE (1.958.00 -> 958) on xxx.xxx.xxx.xxx
> >
> > even though it has the correct version.

> Would  love  to  see  that  script.  Google  didn't provide any hit on
> tupdate.pl.

> Greets,
> _Alain_
----- End forwarded message -----