Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 2 subscribers
  • Views 17844 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Antivirus blocking all ReverseProxy/WAF requests

Sam Malone

Over the last several weeks, we have been discovering that our websites go down for a period of 30-60 seconds a couple of times a day - with a HTTP response code of 400 during the outage.

Looking into the reverseproxy.log file about these outages, we discover that EVERY request for 30-60 seconds is (erroneously) flagged by the avscan engine as containing a virus. Example snippet, deidentified:

2017:01:13-09:32:52 asg-2 reverseproxy: [Fri Jan 13 09:32:52.839143 2017] [avscan:error] [pid 20852:tid 3910048624] [client x.x.x.x:31754] [20852] virus daemon error found in request blah-blah/blah.php, referer: http://blah.blah/blah
2017:01:13-09:32:52 asg-2 reverseproxy: [Fri Jan 13 09:32:52.953336 2017] [avscan:notice] [pid 20852:tid 3910048624] [client x.x.x.x:31754] mod_avscan_input_filter: virus found, referer: http://blah.blah/blah
2017:01:13-09:32:52 asg-2 reverseproxy: [Fri Jan 13 09:32:52.954189 2017] [proxy_http:error] [pid 20852:tid 3910048624] (13)Permission denied: [client x.x.x.x:31754] AH01095: prefetch request body failed to y.y.y.y:80 (y.y.y.y) from 204.63.207.1 (), referer: http://blah.blah/blah

We first started noticing this behavior in about middle of December 2016. We have since upgraded the firmware to most recent 9.409-9 and still noticing the issue.

I am worried that the AVScan patterns are operating incorrectly - that's the only thing I can imagine at this point to be the issue.

Does anyone have any input or advice?

Cheers!



This thread was automatically locked due to age.
Parents
  • 0

    Hi, Sam, and welcome to the UTM Community!

    It's likely that one of the two AV pattern updates is bad.  Switch to single-scan if you haven't already.  If the problem reoccurs, switch to the other scanner in 'Management >> System Settings'.  Any luck with that?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks for the suggestion, Bob.  Single-scan is set for all my WAF profiles.  Will switching the AV scan engine cause a reboot of the reverseproxy service?

    I suspected that pattern update may have been faulty - but then wouldn't A) more people be having the same issue as me or B) newer pattern updates are overwriting any faulty ones?

    This is an HA cluster of two nodes as well, and master/slave switchover has administratively happened several times since we started seeing this problem - does that mean that the possibly corrupt pattern would or would not pass during the node switchover?

    Cheers

    SAM

Reply
  • 0 in reply to BAlfson

    Thanks for the suggestion, Bob.  Single-scan is set for all my WAF profiles.  Will switching the AV scan engine cause a reboot of the reverseproxy service?

    I suspected that pattern update may have been faulty - but then wouldn't A) more people be having the same issue as me or B) newer pattern updates are overwriting any faulty ones?

    This is an HA cluster of two nodes as well, and master/slave switchover has administratively happened several times since we started seeing this problem - does that mean that the possibly corrupt pattern would or would not pass during the node switchover?

    Cheers

    SAM

Children
Unfiltered HTML