Issue DRWeb logging to root console

[uniauto]

Server operating system version

Debian 12.6

Plesk version and microupdate number

Plesk Obsidian 18.0.62

Hi.

Since I migrated my server from Debian 10 to Debian 12 I have a strange issue that all logings from DrWeb is shown directly into the root console / SSH Terminal Extension.
This is not happening with SSH clients(Login as user debian, then using sudo su)

drweb32.ini and drweb_handler.conf on new and old server are equals the same.

Found this related thread

DRWeb logging to console

Hi Everybody, since some days I have the strange issue that all logings from DrWeb is shown directly into the console. For example if I connect to my Server via SSH and then I sned an email to my email accoutn I see the logging of the spool. root@************:~# 2015 Mar 25 16:44:57 *...

talk.plesk.com

Tried to remove/install again Parallels Premium antivirus.

Triend to edit /etc/drweb/drweb32.ini and set Quiet Mode
# OutputMode = {Quiet|Terminal}
# Information output mode at start.
OutputMode = Quiet

Nothing worked.

grep -i log /etc/drweb/drweb32.ini

# LogFileName = {FilePath}
# Log filename.
LogFileName = syslog
# SyslogFacility = {
# Sets the log type when using syslogd system service.
SyslogFacility = Daemon
# SyslogPriority = {Error|Info|Notice|Warning|Alert}
# Sets the log priority when using syslogd system service.
# SyslogPriority = Info
# LimitLog = {Boolean}
# Specifies whether the log file size must be limited, or not.
LimitLog = no
# MaxLogSize = {Digital}
# Maximum log file size.
MaxLogSize = 512
# LogScanned = {Boolean}
# Whether to log or not information about all checked objects (infected and
LogScanned = yes
# LogPacked = {Boolean}
# Whether to log or not additional information about files packed by DIET, PKLITE
LogPacked = yes
# LogArchived = {Boolean}
# Whether to log or not additional information about files archived by RAR, ZIP,
LogArchived = yes
# LogTime = {Boolean}
# Whether to log or not the time for each record.
LogTime = yes
# LogProcessInfo = {Boolean}
# Whether to log or not clients address (hostname or IP) and PID of every
LogProcessInfo = yes
# ClientsLogs = {String}
# Splitting the log files.
# ClientsLogs = drwebdc:/var/drweb/log/drwebdc.log,smb_spider:syslog,mail:/var/drweb/log/drwebmail.log,kerio:syslog,lotus:syslog
# Enables output of update session log to stdout.
# ProxyLogin = {String}
ProxyLogin =
# LogFileName = {FilePath}
# Log filename.
LogFileName = syslog
# LogLevel = {Quiet|Error|Warning|Info|Verbose|Debug}
# Log verbosity level.
LogLevel = Info
# SyslogFacility = {
# Sets the log type when using syslogd system service.
SyslogFacility = Daemon

grep -i log /etc/drweb/drweb_handler.conf

# Logging section #
[Logging]
# Logging detalization ( Quiet, Errors, Alerts, Info, Verbose, Debug )
# Facility used for logging to syslog ( Daemon, Mail, Local0..7 )
SyslogFacility = Mail
# Priority used for logging to syslog ( Debug, Info, Notice, Alert )
SyslogPriority = Info

/etc/syslog-ng/scl.conf

@module appmodel
@include 'scl/*/*.conf'
@define java-module-dir "`module-install-dir`/java-modules"

/etc/syslog-ng/syslog-ng.conf

@version: 3.38
@include "scl.conf"

# Syslog-ng configuration file, compatible with default Debian syslogd
# installation.

# First, set some global options.
options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
dns_cache(no); owner("root"); group("adm"); perm(0640);
stats_freq(0); bad_hostname("^gconfd$");
};

########################
# Sources
########################
# This is the default behavior of sysklogd package
# Logs may come from unix stream, but not from another machine.
#
source s_src {
system();
internal();
};

# If you wish to get logs from remote machine you should uncomment
# this and comment the above source line.
#
#source s_net { tcp(ip(127.0.0.1) port(1000)); };

########################
# Destinations
########################
# First some standard logfile
#
destination d_auth { file("/var/log/auth.log"); };
destination d_cron { file("/var/log/cron.log"); };
destination d_daemon { file("/var/log/daemon.log"); };
destination d_kern { file("/var/log/kern.log"); };
destination d_lpr { file("/var/log/lpr.log"); };
destination d_mail { file("/var/log/maillog"); };
destination d_syslog { file("/var/log/syslog"); };
destination d_user { file("/var/log/user.log"); };
destination d_uucp { file("/var/log/uucp.log"); };

# This files are the log come from the mail subsystem.
#
destination d_mailinfo { file("/var/log/mail.info"); };
destination d_mailwarn { file("/var/log/mail.warn"); };
destination d_mailerr { file("/var/log/mail.err"); };

# Logging for INN news system
#
destination d_newscrit { file("/var/log/news/news.crit"); };
destination d_newserr { file("/var/log/news/news.err"); };
destination d_newsnotice { file("/var/log/news/news.notice"); };

# Some 'catch-all' logfiles.
#
destination d_debug { file("/var/log/debug"); };
destination d_error { file("/var/log/error"); };
destination d_messages { file("/var/log/messages"); };

# The root's console.
#
destination d_console { usertty("root"); };

# Virtual console.
#
destination d_console_all { getvirtconsole(); };

# The named pipe /dev/xconsole is for the nsole' utility. To use it,
# you must invoke nsole' with the -file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
destination d_xconsole { pipe("/dev/xconsole"); };

# Send the messages to an other host
#
#destination d_net { tcp("127.0.0.1" port(1000) log_fifo_size(1000)); };

# Debian only
destination d_ppp { file("/var/log/ppp.log"); };

########################
# Filters
########################
# Here's come the filter options. With this rules, we can set which
# message go where.

filter f_dbg { level(debug); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_err { level(err); };
filter f_crit { level(crit .. emerg); };

filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };
filter f_error { level(err .. emerg) ; };
filter f_messages { level(info,notice,warn) and
not facility(auth,authpriv,cron,daemon,mail,news); };

filter f_auth { facility(auth, authpriv) and not filter(f_dbg); };
filter f_cron { facility(cron) and not filter(f_dbg); };
filter f_daemon { facility(daemon) and not filter(f_dbg); };
filter f_kern { facility(kern) and not filter(f_dbg); };
filter f_lpr { facility(lpr) and not filter(f_dbg); };
filter f_local { facility(local0, local1, local3, local4, local5,
local6, local7) and not filter(f_dbg); };
filter f_mail { facility(mail) and not filter(f_dbg); };
filter f_news { facility(news) and not filter(f_dbg); };
filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_dbg); };
filter f_user { facility(user) and not filter(f_dbg); };
filter f_uucp { facility(uucp) and not filter(f_dbg); };

filter f_cnews { level(notice, err, crit) and facility(news); };
filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); };

filter f_ppp { facility(local2) and not filter(f_dbg); };
filter f_console { level(warn .. emerg); };

########################
# Log paths
########################
log { source(s_src); filter(f_auth); destination(d_auth); };
log { source(s_src); filter(f_cron); destination(d_cron); };
log { source(s_src); filter(f_daemon); destination(d_daemon); };
log { source(s_src); filter(f_kern); destination(d_kern); };
log { source(s_src); filter(f_lpr); destination(d_lpr); };
log { source(s_src); filter(f_syslog3); destination(d_syslog); };
log { source(s_src); filter(f_user); destination(d_user); };
log { source(s_src); filter(f_uucp); destination(d_uucp); };

log { source(s_src); filter(f_mail); destination(d_mail); };
#log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); };
#log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); };
#log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); };

log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); };
log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); };
log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); };
#log { source(s_src); filter(f_cnews); destination(d_console_all); };
#log { source(s_src); filter(f_cother); destination(d_console_all); };

#log { source(s_src); filter(f_ppp); destination(d_ppp); };

log { source(s_src); filter(f_debug); destination(d_debug); };
log { source(s_src); filter(f_error); destination(d_error); };
log { source(s_src); filter(f_messages); destination(d_messages); };

log { source(s_src); filter(f_console); destination(d_console_all); destination(d_xconsole); };
log { source(s_src); filter(f_crit); destination(d_console); };

# All messages send to a remote site
#
#log { source(s_src); destination(d_net); };

###
# Include all config files in /etc/syslog-ng/conf.d/
###
@include "/etc/syslog-ng/conf.d/*.conf"

Thanks for any hints.

 

[AndreasMatrix]

Ich habe das gleiche Problem und bnötige schnelle Hilfe.

Da ein arbeiten mit dem root user nur sehr schwer möglich ist. Oder der drwebd dafür gestoppt werden muss.

Wenn ich eine aktive root SHH session offen habe schreibt ständig der drwebd mit ins terminal.
Bei mir handelt es sich im neu installierte und nicht migrierte server, aber ebenfalls Debian 12 und Plesk.

 

[AndreasMatrix]

I have the same problem and need quick help.

Because working with the root user is very difficult. Or the drwebd has to be stopped for this.

If I have an active root SHH session open, drwebd constantly writes to the terminal.
For me it is a newly installed and not migrated server, but also Debian 12 and Plesk.

 

[Sebahat.hadzhi]

Hello, guys. There is an older thread with an identical issue. Please let us know if that worked out for you.

 

[AndreasMatrix]

I found that solutions already, but it didnt work for me.
My solutions a Switch to Sophos AV.

 

[uniauto]

Hello, guys. There is an older thread with an identical issue. Please let us know if that worked out for you.

I found that solution too, but it didnt work.