Resolved DrWeb Antivirus sends many notifications "Your virus bases are obsolete."

[Peter Debik]

The message file is very huge now - is it save to delete it?

It is no good idea to delete it. It would be better to rotate it. When you simply delete it, the open file handle stays in RAM and new log entries won't be written, because the file that the handle is using is missing. When you rotate it, your current file will be stored (and as best practice compressed) and a new one will be initialized with a new file handle so that logging keeps working.
Do you see a /etc/logrotate.d/syslog file? Then you can probably run logrotate -f /etc/logrotate.d/syslog to rotate the file.

 

[Peter Debik]

My problem is that I havent drweb extension installed so I cannot unistall, I havent Plesk Premium antivirus ... so I cannot unistall nothing but I receive these emails every minute

All Plesk installations have DrWeb installed by default. When you do not purchase the premium antivirus solution you can still check the antivirus function and it will work for the first n (I think it is 5) domains for free. That is why it comes with Plesk by default. There is nothing wrong with having DrWeb on the server.

 

[carini]

I havent this. I have no antivirus

Use service provider view:

Left menu -> Extensions -> My Extensions

 

[carini]

All Plesk installations have DrWeb installed by default. When you do not purchase the premium antivirus solution you can still check the antivirus function and it will work for the first n (I think it is 5) domains for free. That is why it comes with Plesk by default. There is nothing wrong with having DrWeb on the server.

But it shouldn't be installed automatically if you have another antivirus / security solution in place and, above all, shouldn't be installed during an upgrade.

 

[ozc]

Hello

Same issue for me

x:~# systemctl stop drwebd
Failed to stop drwebd.service: Unit drwebd.service not loaded.

How can i stop these emails ?

 

[Dave W]

Update: According to developers after careful consideration there won't be a hotfix as we initially thought there would, because the issue is a one-time issue. The workaround provided in Important - DrWeb Antivirus sends many notifications "Your virus bases are obsolete." (stop - killall -start) is already the final solution.

Hi Peter,
They need to reconsider this, a couple of hundred servers generating this kind of noise after an update is not acceptable.
Regards
D.

 

[Peter Debik]

Hello

Same issue for me

x:~# systemctl stop drwebd
Failed to stop drwebd.service: Unit drwebd.service not loaded.

How can i stop these emails ?

Have you seen the very first post of this thread?

Resolved - DrWeb Antivirus sends many notifications "Your virus bases are obsolete."

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like Jul 25 09:50:22 shared3 drwebd: Interface binding error (/var/drweb/run/.daemon - Address already in use)! Jul 25 09:50:22 shared3 drwebd...

talk.plesk.com

Also you can clear the mail queue of the server afterwards, because previously submitted mails may still wait on delivery in the queue.

 

[counterweightmedia]

Excuse my ignorance - are we to use this solution first or attempt 1.) and 2.) from the first post prior to these new suggestion here?

After further analysis, developers are suggesting a new workaround approach:

systemctl stop drwebd
killall -TERM drwebd.real
systemctl start drwebd

 

[Peter Debik]

You can use the later solution directly. It basically does the same as the solution (2) from my first post, but a bit shorter, easier and more reliable. The other solution still works, but may need a second try if cron restarts drwebd while you are still killing processes. This is less likely to happen with the killall -TERM solution.

 

[Dork]

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like

Is Plesk Premium Antivirus combined with watchdog?

 

[Peter Debik]

Among others, Watchdog can monitor Plesk Premium Antivirus.

 

[counterweightmedia]

You can use the later solution directly. It basically does the same as the solution (2) from my first post, but a bit shorter, easier and more reliable. The other solution still works, but may need a second try if cron restarts drwebd while you are still killing processes. This is less likely to happen with the killall -TERM solution.

Thank you very much for your response. Still coming up to speed in this area. I did see that the extension had an update for today 1.0.2-2 which appears to address the issue on 7/24/23 update in the changelog. Hopefully, this will fix the issue. If installing the update is completed - would I need to proceed with the solution after the extension update?

 

[ozc]

Have you seen the very first post of this thread?

Resolved - DrWeb Antivirus sends many notifications "Your virus bases are obsolete."

After an update of the antivirus extension last night, DrWeb is caught in a restart loop on many servers. In your system log you can see messages like Jul 25 09:50:22 shared3 drwebd: Interface binding error (/var/drweb/run/.daemon - Address already in use)! Jul 25 09:50:22 shared3 drwebd...

talk.plesk.com

Also you can clear the mail queue of the server afterwards, because previously submitted mails may still wait on delivery in the queue.

yes i had read the whole topic i had no dr.web process running nor email in queue. I reinstalled plesk premium antivirus then i removed it again and that stopped

 

[Olga]

The issue was fixed in Premium Antivirus for Servers version 1.0.2-2 yesterday. Updating to this version will fix the issue.
If an extension update is not possible for some reason, a workaround is the same as suggested above:
systemctl stop drwebd
killall -TERM drwebd.real
systemctl start drwebd

 

[spip]

After further analysis, developers are suggesting a new workaround approach:

systemctl stop drwebd
killall -TERM drwebd.real
systemctl start drwebd

Hello,
It worked for me. Thank you for the help