Re: trend-update.pl question
Alain Fauconnet <[email protected]> Wed, 8 Dec 2004 09:31:15 +0700
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hi Bill, [list [email protected] Cc'ed as it tends to be the de-facto list for the few questions about trend-update.pl... at least until Vanja asks me to move elsewhere :-)] On Mon, Nov 29, 2004 at 11:01:27PM -0800, Bill Landry wrote: > Hi Alain, > > Yesterday I downloaded and started using your trend-update.pl script, and > all appears to be working well (I've gotten several updates in the last 24 > hours). I noticed that the update e-mail notification for the first 12 > hours or so looked like this, with the version info changing with each > actual update: > ===== > Trend Micro A-V Pattern/Engine Update v1.02 starting at Mon Nov 29 13:04:34 > 2004 > Checking existing VPN/CPR pattern number/version > Current VPN: major = 2, number = 267, version = 00 > Current CPR: major = 2, number = 268, version = 04 > Current ENG: version = 7.000-1011 > No update done > ===== > > However, all updates notifications since the one shown above have looked > like this (probably the last 10 hourly updates): > ===== > Trend Micro A-V Pattern/Engine Update v1.02 starting at Mon Nov 29 14:03:15 > 2004 > Checking existing VPN/CPR pattern number/version > Trophie reports pattern number = 269, assumed major = 2, version = 0 > Current VPN: major = 2, number = 269, version = 0 > Current CPR: major = 2, number = ???, version = ??? > Current ENG: version = 7.000-1011 > No update done > ===== > > Note the "???" in the CPR line above. Is this something that I should be > concerned about? All previous updates notification listed numbers, not > "???". Yes you should. This isn't normal. It means that the script has been unable to determine which version of CPR you have at this time. It can normally happen the first time the script is run, but definitely not after successful updates. Something has been messed up. Please post the contents of the ./update/numver.dat file found under whatever $trenddir is set to e.g. if $trenddir is set to '"/opt/TrendMicro/SProtectLinux" (the default), then the file will be /opt/TrendMicro/SProtectLinux/update/numver.dat Also please post the result of a ls -l in that ./update directory and a 'ls -l lpt*' in the directory above (the value of $trenddir). > > Also, what do VPN and CPR stand for? > The VPNs are the official pattern releases. They tend to have an odd middle version number and '00' as the minor number. The CPRs are the interim, "beta" pattern releases. They tend to have an even middle version number and can have several incrementing minor version numbers. Trend does not recommend them for production usage, but in my opinion, they are quite needed to feed a virus scanning mail gateway. See: http://www.trendmicro.com/download/pattern.asp for the official gospel. Greets, _Alain_