Re: trend-update.pl v1.00 released

Hi Alain

Alain Fauconnet wrote:
>>Regarding this question, I found the following TM knowledge base 
>>article: 
>>http://kb.trendmicro.com/solutions/search/main/search/solutionDetail.asp?solutionID=3235 

> Hmmm.  This  article  seems to be a more definite answer than anything
> I've read so far. Until now, it wasn't clear to me ... [snip]

I agree that TrendMicro's documentation is not very clear in a lot of 
places. I have found that to be the case with a lot of commercial 
software, though, TM isn't alone there. :-/

>>2. Don't do anything and have the InterScan admin set the following 
>>options in intscan.ini:
>>
>>  update=auto
>>  update_interval=<check_interval_in_minutes>
>>
>>In any case, since trend-update.pl is updating the pattern files, 
>>VirusWall's own autoupdate should be deactivated with the following 
>>options in intscan.ini:
>>
>>  Method=Automatic
>>  Frequency=none
> 
> In that case, when if ever will it notice the updated  patterns?  It's
> not clear to me.

The way I understood the article, setting update=auto causes the 
InterScan daemons to check the pattern file periodically to see if they 
need to reload it.

I'm not sure what 'Method=Automatic' does, the article doesn't really 
explain it, but just says, "This means that the program will not 
automatically update the pattern. You still need to set the following 
options to do the schedule pattern download." I am guessing that they 
meant to say that 'Method=Automatic' tells VirusWall to download pattern 
updates automatically, but that you need to specify a frequency as well, 
so specifying 'Method=Automatic' alone doesn't suffice to make VirusWall 
actually download pattern updates.

Since I don't want VirusWall to download the patterns (I want 
trend-update.pl to do that), I set 'Frequence=none', so VirusWall never 
performs downloads. 'Method=Automatic' is apparently entirely 
superfluous, but since I don't know how VirusWall will react if I omit 
the option, I left it there with the only value I know it can hold.

>>I have now used the second strategy.
> 
> What  did  you  observe?  Was  VirusWall  using  the  updated patterns
> downloaded  by  my  script?  (is  there  any   way   to   see   this?)

Yes, it appears to be using those patterns. At least that's what the 
'About' tab in the web based VirusWall administration thingy says.

> That sounds like a good approach. Using strace can be another. It will
> show you if a process gets SIGHUPed.

Yeah, I use strace occasionally as well, but I expect my method to be 
simpler here -- strace typically gives you so much output that it's a 
bit of a chore to sift through it. Of course, there may be some clever 
options to strace so you're shown only signals... (?)

>>On to a different topic: Scan engine update. When trend-update.pl has 
[snip]

> Well,  I  presume  that  Viruswall  installs /etc/init.d script(s?) to
> start/stop the various daemons. You could just invoke these from
> a wrapper script that calls *both* the Trophie start/stop script and  the
> ones  from   Viruswall.   Then   just   define   $starttophiecmd   and
> $stoptrophiecmd as calls to this wrapper script.

Yep, that's what I'm in the course of implementing.

> All  this  raises  the  question  of  making  trend-update.pl  a  more
> general tool. Right now it's clearly focused to Trophie only. It's
> not aimed at becoming a general tool to manage update of  the  various
> Trend products on Linux. I'm thinking about this, but I won't have the
> time to  make  massive  changes  to  it  in  the  foreseeable  future.

Well, because I'm using trophie as well as the VirusWall HTTP scanner on 
the same machine, I need a way of updating pattern files and scan 
engines in a way compatible with trophie and VirusWall. trend-update.pl 
is great for trophie and I like its extra features over the VirusWall 
updater, so I'd like to be able to use it as the only AV update tool and 
therefore I need to extend it to support VirusWall. I don't have any 
other TrendMicro products, though, so I'll stop when the current task is 
completed. trend-update.pl definitely has the potential to develop into 
a more general tool, though.

Cheers,
Tobias