got a strange error with the virus scanner on an ASG install on a PC. Here is what I captured from the logs:
Last working mail fetch via POP3 was at 2010:09:14-10:50:05 (GMT+2)
Last update before the problem started:
2010:09:14-12:57:01 hobbit audld[30792]: Starting Up2Date Package Downloader
2010:09:14-12:57:01 hobbit audld[30792]: patch up2date possible
2010:09:14-12:57:05 hobbit audld[30792]: id="3701" severity="info" sys="system" sub="up2date" name="Authentication successful"
2010:09:14-12:57:06 hobbit audld[30792]: id="3707" severity="info" sys="system" sub="up2date" name="Successfully synchronized fileset" status="success" action="download" package="avira"
2010:09:14-12:57:06 hobbit auisys[30815]: Starting Up2Date Package Installer
2010:09:14-12:57:07 hobbit auisys[30815]: Searching for available up2date packages for type 'man8'
2010:09:14-12:57:07 hobbit auisys[30815]: id="371D" severity="info" sys="system" sub="up2date" name="No up2date packages available for installation" status="failed" action="preinst_check" package="man8"
2010:09:14-12:57:12 hobbit auisys[30815]: Searching for available up2date packages for type 'avira'
2010:09:14-12:57:12 hobbit auisys[30815]: Installing up2date package file '/var/up2date//avira/u2d-avira-7.2328-2329.patch.tgz.gpg'
2010:09:14-12:57:12 hobbit auisys[30815]: Verifying up2date package signature
2010:09:14-12:57:12 hobbit auisys[30815]: Unpacking installation instructions
2010:09:14-12:57:13 hobbit auisys[30815]: Unpacking up2date package container
2010:09:14-12:57:13 hobbit auisys[30815]: Running pre-installation checks
2010:09:14-12:57:13 hobbit auisys[30815]: Starting up2date package installation
2010:09:14-12:57:25 hobbit auisys[30815]: id="371Z" severity="info" sys="system" sub="up2date" name="Successfully installed Up2Date package" status="success" action="install" package_version="7.2329" package="avira"
2010:09:14-12:57:25 hobbit auisys[30815]: New Pattern Up2Dates installed
2010:09:14-12:57:30 hobbit auisys[30815]: Searching for available up2date packages for type 'ohelpng'
2010:09:14-12:57:30 hobbit auisys[30815]: id="371D" severity="info" sys="system" sub="up2date" name="No up2date packages available for installation" status="failed" action="preinst_check" package="ohelpng"
2010:09:14-12:57:35 hobbit auisys[30815]: id="3716" severity="info" sys="system" sub="up2date" name="Up2date Package Installer finished, exiting"
Repeating errors since then:
2010:09:14-14:19:00 hobbit pop3proxy[1247]: Unknown cssd response: 500 Internal Server Error
2010:09:14-14:19:00 hobbit pop3proxy[1247]: Fatal: Scan failed due to some weird reason
Then the next update was installed but that did not change anything (neither did the following updates):
2010:09:14-14:57:11 hobbit auisys[2241]: Installing up2date package file '/var/up2date//avira/u2d-avira-7.2329-2330.patch.tgz.gpg'
This is what the HTTP proxy reported in the logs (repeated later on):
2010:09:14-14:57:18 hobbit httpproxy[4879]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="avira_reload" file="avirascanner.c" line="502" message="reloading av pattern"
2010:09:14-14:57:18 hobbit httpproxy[4879]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="avira_loaddb" file="avirascanner.c" line="478" message="Avira init failed: 17 (Engine modified)"
2010:09:14-14:57:18 hobbit httpproxy[4879]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="avira_reload" file="avirascanner.c" line="514" message="reloading av pattern finished"
2010:09:14-15:04:32 hobbit httpproxy[4879]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xeee62c50" function="avira_scan" file="avirascanner.c" line="380" message="failed to get scanner instance"
I tried to refresh the patterns in "/var/storage/chroot-http/var/pattern" using patterndist and rebooted the machine but that did not help.
What looks suspicious to me is the ownerships of the pattern directories:
drwxr-xr-x 5 httpproxy root 4096 2010-09-02 20:50 .
drwxr-xr-x 9 httpproxy root 4096 2010-09-14 20:28 ..
drwxr-xr-x 2 httpproxy root 4096 2010-09-15 23:42 avira
drwxr-xr-x 2 root root 4096 2010-09-14 18:43 clamav
drwxr-xr-x 2 httpproxy root 4096 2010-09-02 20:50 geoip
I was actually used to have most of these at "root root" which is the case inside for the single files. But since no read access is lost with these permissions I do not think that this is the real reason.
The other thing that looks strange is the message "Avira init failed: 17 (Engine modified)". On a PC I would assume that I caught a virus that tried to kill my AV scanner but this is not very likely on such a gateway.
At this point I have no more idea what might be wrong. Searching the forum and Google did not show any case like this. Maybe someone has an idea.
Thanks for stopping by.
Andreas
This thread was automatically locked due to age.
