Re: trend-update.pl v1.00 released

Hi Alain

Alain Fauconnet wrote:
> On Wed, Oct 06, 2004 at 11:21:53AM +0200, Tobias Reckhard wrote:
>>I see that you handle reloading and/or restarting of trophie in your 
>>script. But what about the VirusWall itself or, more specifically and in 
>>my case, the HTTP scanner? Do you know if it needs to be signalled 
>>and/or restarted as well?
> 
> No idea, sorry. I don't use VirusWall  myself.  The  box  I'm  running
> Trophie on actually has a ServerProtect license.

Yeah, I gathered as much from the script.

> The safest would be, of course, to stop and restart VirusWall from the
> code section in trend-update.pl that SIGHUPs Trophie.
> But you may dislike this.

I'll investigate that. There's a Squid proxy on the same box which 
forwards requests to the VirusWall, so the question then is how Squid 
behaves when it temporarily can't reach its parent.

> Does  VirusWall  try  to  update  itself  at  fixed  hours  just  like
> ServerProtect   does   (from   a   crontab   job)?

Its update frequency is configurable and is set to hourly at the moment. 
I don't know if it uses a cron-job or implements a scheduling facility 
of its own. root's crontab does contain the following:

	0 * * * * /etc/iscan/prescan.cgi
	30 2 * * * /etc/iscan/cleanscan
	0 2 * * * /etc/iscan/purgefile

But it doesn't look like those relate to the automatic update. I just 
tried modifying the update schedule, but the crontab entries didn't 
change. After having looked at the logs, the hourly update appears to 
take place at <hour>:00:00.

>   If  so,  I'd  put
> trend-update.pl aside, let VirusWall do its  updates  and  watch  what
> happens  at  that  time  (possibly  by  stracing  the master VirusWall
> process - that'll tell you whether it gets a signal of  some  sort  or
> what does it do).

Yes, I may do that. The following snippet from the intscan.ini file is a 
bit interesting:

   # how to update virus pattern:
   #   signal:     update when SIGHUP is received
   #   auto:       update periodically, as specified by update_interval
   #   disabled:   never update
   # This parameter doesn't affect the InterScan v3.81 http
   update=signal

However, I'm a bit confused by the note that seems to say that a SIGHUP 
doesn't affect the HTTP scanner..

> That's the best hint I can come up with...

Thanks a lot, your pointers are very good.

Cheers,
Tobias