Re: trend-update.pl v1.00 released

Hi Alain

I dug around a bit and came upon a few results.

Alain Fauconnet wrote:
> On Wed, Oct 06, 2004 at 11:21:53AM +0200, Tobias Reckhard wrote:
[snip]
>>I see that you handle reloading and/or restarting of trophie in your 
>>script. But what about the VirusWall itself or, more specifically and in 
>>my case, the HTTP scanner? Do you know if it needs to be signalled 
>>and/or restarted as well?

Regarding this question, I found the following TM knowledge base 
article: 
http://kb.trendmicro.com/solutions/search/main/search/solutionDetail.asp?solutionID=3235 
(mind any line wrapping that may be introduced).

So it appears trend-update.pl could use two strategies:

1. Send the InterScan daemons a SIGHUP when it's downloaded the pattern 
update, just like it does to trophie. I haven't tried this, though, 
because I'm not sure how to find the PIDs of the relevant daemons yet.

2. Don't do anything and have the InterScan admin set the following 
options in intscan.ini:

   update=auto
   update_interval=<check_interval_in_minutes>

In any case, since trend-update.pl is updating the pattern files, 
VirusWall's own autoupdate should be deactivated with the following 
options in intscan.ini:

   Method=Automatic
   Frequency=none

I have now used the second strategy. I will probably investigate 
strategy 1, though, since it seems more elegant. I expect to be able to 
find out which processes need a SIGHUP sent to them by selectively 
stopping and restarting the individual VirusWall components and checking 
the system's process table.

> The safest would be, of course, to stop and restart VirusWall from the
> code section in trend-update.pl that SIGHUPs Trophie.
> But you may dislike this.

The problem I see here is the disruption of service. I need to restart 
VirusWall when performing an engine update (more on that later), but I'd 
like to do it only then.

> Does  VirusWall  try  to  update  itself  at  fixed  hours  just  like
> ServerProtect   does   (from   a   crontab   job)?

Yes, apparently, that's what the prescan.cgi command in root's crontab 
does. The crontab entry doesn't change when you modify update frequency 
or date, so prescan.cgi must read intscan.ini.

On to a different topic: Scan engine update. When trend-update.pl has 
performed a scan engine update, it restarts trophie, so the latter loads 
the new libvsapi.so. I need to restart the VirusWall daemons for the 
same reason. I found the following KB article on how to manually update 
the scan engine: 
http://kb.trendmicro.com/solutions/search/main/search/SolutionDetail.asp?SolutionID=8352&btnSearch=+GO+

I'll see if I can extend trend-update.pl myself, but I'm not much of a 
Perl coder myself.. I'll let myself be guided by what you did for 
trophie and send you the result when I'm done.

Cheers,
Tobias