[trend-update.pl v1.02] Non fatal error while updating signatures
Marco Borrini <[email protected]> Wed, 08 Dec 2004 00:48:26 +0100
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Today I've finished the configuration of Qmail + Amavis + Trophie + TM
VirusWall + ClamAV and I'm testing trend-update.pl to manage automatic
update of virus signatures.
The process seems to work well but the cron output always show me the
following error when an update is available:
========
Trend Micro A-V Pattern/Engine Update v1.02 starting at Tue Dec 7
18:30:01 2004
Checking existing VPN/CPR pattern number/version
Reading /opt/trend/ISBASE/IScan.BASE/update/numver.dat
Found VPN major = 2, number = 285, version = 00
Found CPR major = 2, number = 286, version = 03
Trophie reports engine version = 7.000-1011
Current VPN: major = 2, number = 285, version = 00
Current CPR: major = 2, number = 286, version = 03
Current ENG: version = 7.000-1011
Checking VPN whatsnew.txt
Unchanged
Checking VPN pattern number/version
Found pattern major = 2, number = 285, version = 00 in
/opt/trend/ISBASE/IScan.BASE/update/vpn_whatsnew.txt
VPN not newer than currently used: no VPN download
Checking CPR whatsnew.txt
Checking CPR pattern number/version
Found pattern major = 2, number = 286, version = 04 in
/opt/trend/ISBASE/IScan.BASE/update/cpr_whatsnew.txt
Downloading CPR lpt286.zip
Extracting /opt/trend/ISBASE/IScan.BASE/update/lpt286.zip to
/opt/trend/ISBASE/IScan.BASE ...
... lpt$vpn.286
CPR updated: major = 2, number = 286, version = 04
Updating links in /etc/iscan ...
... lpt$vpn.286
Updating links in /opt/trend/ISBASE/IScan.BASE ...
===>
===> ERROR: can't create link /opt/trend/ISBASE/IScan.BASE/lpt$vpn.286
-> /opt/trend/ISBASE/IScan.BASE/lpt$vpn.286
===>
Updated: lpt$vpn.286 Deleting old pattern files
Scanning /opt/trend/ISBASE/IScan.BASE
Found pattern number = 285 ...
Found pattern number = 286 ...
Got Trophie PID = 7173 from file /var/run/trophie.pid
lsof output: p7173
[......]
lsof_search found processes: 7173
Got Trophie PID = 7173 by running lsof
Sending null signal to Trophie[7173]
========
I can image that this is a non fatal error because virus pattern links
in /etc/iscan are set in right way, trophie and VirusWall show correct
version number, but I can't understand why I have to create a symlink to
a file with the same name of the symlink.
Anyway this is my configuration:
========
# Trophie settings
# ----------------
$wantcpr = 1;
$wanteng = 0;
$trophie = "/usr/bin/trophie";
$starttrophiecmd = "/bin/sh /etc/init.d/trophie start";
$stoptrophiecmd = "/bin/sh /etc/init.d/trophie stop";
$delay = 5;
$restart = 0;
$trophiepid = "/var/run/trophie.pid";
$trophiesocket = "/var/run/trophie";
$lsof = "/usr/sbin/lsof";
# Mail report settings
# --------------------
$mailto = '...';
$mailfrom = '...';
$hostname = (uname)[1];
$mailsubj = "Trend update report for $hostname";
$mailmethod = 'qmail';
$mailsmtpserver = 'localhost';
# Settings about links
# --------------------
@linkdirs = ("/etc/iscan", "/opt/trend/ISBASE/IScan.BASE");
# Miscellaneous
# -------------
$verbosity = 2;
$uncompress = "/usr/bin/uncompress";
$chunksize = 512*1024;
# Pattern updates settings (may need adjustments if Trend change this!)
# ------------------------
$cprurl = "http://www.trendmicro.com/ftp/products/pattern/cpr";
$paturl = "http://www.trendmicro.com/ftp/products/pattern";
$engurl = "http://www.trendmicro.com/ftp/products/engine";
$whatsnew = "whatsnew.txt";
$patfmt = "lpt%d.zip";
$patre = 'lpt\$vpn\.([0-9]+)';
$engpage = "http://www.trendmicro.com/download/engine.asp";
$engre = "vsapi-x86-linux-([0-9.-]+)\.tar\.z";
$engfmt = "vsapi-x86-linux-%s.tar\.z";
$engfilre = "libvsapi.so";
# Trend product settings
#$trenddir = "/opt/TrendMicro/SProtectLinux";
$trenddir = "/opt/trend/ISBASE/IScan.BASE";
$tmpdir = $trenddir . "/update";
$numver = $tmpdir . "/numver.dat";
========
I hope that my question is not too stupid!
Best regards,
Marco