• Plesk Uservoice will be deprecated by October. Moving forward, all product feature requests and improvement suggestions will be managed through our new platform Plesk Productboard.
    To continue sharing your ideas and feedback, please visit features.plesk.com

Issue ERROR: Dr.Web Updater: failed to download files ! return code 105

Hello, everyone. Our team got in touch with Dr. Web. At this point, Dr. Web is still reviewing the matter and I cannot confirm what actions will be taken. The only workaround, we can suggest is still changing the update server.
 
This last week i didn't recieved any error emails. Dr Web resolved the matter?
@Tjerk Visser

They did not, all update server - with the exception of one - are still very slow, to the extent that they become unreachable.

The best thing to do is still forcing the IP 85.10.234.30 for updates.

Kind regards...
 
And maybe change the time, or that poor server will be DDoSed by all the plesk installations ...
@mow,

I have tried that (for all IPs associated with DrWeb) and only makes a very very very very small difference ...... and only for the 85.10.234.30 IP.

In theory and in practice, it helps ........ the advantage is quite small.

You can check this by sending a ping to the DrWeb update servers and repeat that a couple of days : the ping times are quite stable and remain very slow, on all IPs associated with DrWeb.

Somehow, this suprises me, since this whole situation really is not necessary.

Kind regards....
 
@chris-design , there is still no clarity on the reason for the issue. According to the escalation to Dr. Web and their engineers debug mode should be enabled to gather more details in order to identify the issue:

Also, can you please edit the logging verbosity in /etc/drweb/drweb32.ini and set it to Debug:

Bash:
# grep -i loglevel /etc/drweb/drweb32.ini
# LogLevel = {Quiet|Error|Warning|Info|Verbose|Debug}
LogLevel = Info
 
@chris-design , there is still no clarity on the reason for the issue. According to the escalation to Dr. Web and their engineers debug mode should be enabled to gather more details in order to identify the issue:
Thank you @Sebahat.hadzhi. I just updated the drweb32.ini on one of my servers and set it to Debug.

I am expecting to receive another email from the server within the next days. What do you want me to share here from the log?
 
Thank you for your cooperation. Usually, it logs into the /var/log/messages or /var/log/syslog files. Let's see if the email notification you get will contain more verbose error, if not, please take a look in the aforementioned files. Thanks in advance.
 
@Sebahat.hadzhi These are the emails from the last days:

2025-09-25 08:54
/etc/cron.daily/drweb-update:
ERROR: Dr.Web Updater: failed to download files !
run-parts: /etc/cron.daily/drweb-update exited with return code 105

2025-09-24 08:35
same

2025-09-23 09:24
same

Here's is a "drweb" grep snippet from today. I needed to shorten it. I hope this helps:

Code:
2025-09-25T06:25:07.993282+00:00 vc4-8 update.pl[3220149]: Dr.Web Updater ($Id: fbb3ca1734c5e75ae3008acef02c2f1032ac44cf $) script path is /opt/drweb/update.pl
2025-09-25T06:25:07.993495+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<workingdir> value=</var/drweb/updater/>)

[shortened]

2025-09-25T06:25:07.995533+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<user> value=<drweb>)
2025-09-25T06:25:07.995572+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<pidfile> value=</var/drweb/run/drwebd.pid>)
2025-09-25T06:25:07.995604+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<mailcommand> value=</usr/sbin/sendmail -i -bm -f drweb -- root>)
2025-09-25T06:25:08.007044+00:00 vc4-8 update.pl[3220149]: Path to bases                 : /var/drweb/bases/

[shortened]

2025-09-25T06:25:08.007531+00:00 vc4-8 update.pl[3220149]: Path to file about last update: /var/drweb/updater/last_try_cache
2025-09-25T06:25:08.007706+00:00 vc4-8 update.pl[3220149]: Path to lzma: \/opt\/drweb\/lzma
2025-09-25T06:25:08.008302+00:00 vc4-8 update.pl[3220149]:   Name(blacklistpath) Value(/var/drweb/dws)

[shortened]

2025-09-25T06:25:08.012987+00:00 vc4-8 update.pl[3220149]: Creating path '/var/drweb/updater/drweb/'...
2025-09-25T06:25:08.041661+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwm11010.vdb, 3357698259, 1686044095) has been called

[shortened]

2025-09-25T06:25:08.048353+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwf11000.vdb, 1902611511, 1686044095) has been called
2025-09-25T06:25:08.048458+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/drwtoday.vdb, 709422280, 1686044095) has been called
2025-09-25T06:25:08.048535+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwm11025.vdb, 2654076607, 1686044096) has been called
2025-09-25T06:25:08.048626+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/drw11002.vdb, 3441877724, 1686044089) has been called
2025-09-25T06:25:08.048870+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/lib/drweb32.dll, 4263071725, 1686044095) has been called
2025-09-25T06:25:08.049060+00:00 vc4-8 update.pl[3220149]: ParseKey(/opt/drweb/drweb32.key) has been called ...
2025-09-25T06:25:08.049178+00:00 vc4-8 update.pl[3220149]: /var/drweb/bases/custom.drl: no such file or no permissions for reading custom URL list
2025-09-25T06:25:08.049234+00:00 vc4-8 update.pl[3220149]: try using Dr.Web URL list (/var/drweb/bases/update.drl)
2025-09-25T06:25:08.049285+00:00 vc4-8 update.pl[3220149]: exec(/opt/drweb/read_signed drl /var/drweb/bases/update.drl) ...
2025-09-25T06:25:08.051076+00:00 vc4-8 update.pl[3220149]:     http://update.geo.drweb.com/plesk/1100/unix
2025-09-25T06:25:08.051478+00:00 vc4-8 update.pl[3220149]: Generating path: component 'drweb', id 'lock'
2025-09-25T06:25:08.051532+00:00 vc4-8 update.pl[3220149]: Generated file path: /var/drweb/updater/drweb/lock
2025-09-25T06:25:08.051637+00:00 vc4-8 update.pl[3220149]: Attempting to fetch http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst ...
2025-09-25T06:25:08.060908+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:25:08.171253+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:25:08.171394+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst.lzma
2025-09-25T06:25:08.171574+00:00 vc4-8 update.pl[3220149]:     GET /plesk/1100/unix/drweb32.lst.lzma?m=e52ee6293550298ec4d7e5c57ade18e5 HTTP/1.0
2025-09-25T06:25:08.171629+00:00 vc4-8 update.pl[3220149]:     Host: update.geo.drweb.com
2025-09-25T06:25:08.171931+00:00 vc4-8 update.pl[3220149]: request with 373 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.281978+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:25:08.282173+00:00 vc4-8 update.pl[3220149]: Forking decoder: \/opt\/drweb\/lzma d -si -so 2>/dev/null
2025-09-25T06:25:08.290196+00:00 vc4-8 update.pl[3220149]: 6550 bytes received from http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst.
2025-09-25T06:25:08.290279+00:00 vc4-8 update.pl[3220149]: using http://update.geo.drweb.com/plesk/1100/unix for downloading updates ...
2025-09-25T06:25:08.292738+00:00 vc4-8 update.pl[3220149]: UpdateLine: +drweb32.dll, B21ED6A4
2025-09-25T06:25:08.292822+00:00 vc4-8 update.pl[3220149]: UpdateTask: operation = +, file = drweb32.dll, check sum = B21ED6A4, API = , platform =
2025-09-25T06:25:08.292895+00:00 vc4-8 update.pl[3220149]: UpdateLine: +drwebase.vdb, 4096E830
2025-09-25T06:25:08.292972+00:00 vc4-8 update.pl[3220149]: UpdateTask: operation = +, file = drwebase.vdb, check sum = 4096E830, API = , platform =
2025-09-25T06:25:08.336008+00:00 vc4-8 update.pl[3220149]:   file =  drweb32.dll, check sum = 2988365476
2025-09-25T06:25:08.336056+00:00 vc4-8 update.pl[3220149]:   file = drwebase.vdb, check sum = 1083631664
2025-09-25T06:25:08.339729+00:00 vc4-8 update.pl[3220149]: FullPath( drw11000.vdb ) return( /var/drweb/bases/drw11000.vdb )
2025-09-25T06:25:08.339775+00:00 vc4-8 update.pl[3220149]: getCheckSum(/var/drweb/bases/drw11000.vdb) has been called


[shortened]

2025-09-25T06:25:08.377320+00:00 vc4-8 update.pl[3220149]: File '/var/drweb/bases/update.drl' exists, trying to find info about file in cache...
2025-09-25T06:25:08.377540+00:00 vc4-8 update.pl[3220149]: Trying to find info about file 'update.drl' for component 'drweb' in last update cache...
2025-09-25T06:25:08.377592+00:00 vc4-8 update.pl[3220149]: No info about file 'update.drl' for component 'drweb' in last update cache!
2025-09-25T06:25:08.377661+00:00 vc4-8 update.pl[3220149]: http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb will be downloaded to /var/drwe/spool/drw11000.vdb.l6o2VT3A ...
2025-09-25T06:25:08.377970+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb.lzma
2025-09-25T06:25:08.378191+00:00 vc4-8 update.pl[3220149]:     Host: update.geo.drweb.com
2025-09-25T06:25:08.378506+00:00 vc4-8 update.pl[3220149]: request with 374 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.528107+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 404 Not Found
2025-09-25T06:25:08.529542+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:25:08.604964+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:25:08.605107+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:25:08.605312+00:00 vc4-8 update.pl[3220149]:     Host: update.geo.drweb.com
2025-09-25T06:25:08.605740+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.681175+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:26:00.015155+00:00 vc4-8 systemd[1]: cron.service: Unit process 3220147 (drweb-update) remains running after unit stopped.
2025-09-25T06:26:00.016404+00:00 vc4-8 systemd[1]: cron.service: Found left-over process 3220147 (drweb-update) in control group while starting unit. Ignoring.
2025-09-25T06:26:38.005984+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:26:38.006788+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:26:38.127900+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:26:38.128016+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:26:38.128233+00:00 vc4-8 update.pl[3220149]:     Host: update.geo.drweb.com
2025-09-25T06:26:38.128502+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:26:38.251147+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:28:08.013781+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:28:08.014869+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:28:08.133545+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:28:08.133871+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:28:08.134344+00:00 vc4-8 update.pl[3220149]:     Host: update.geo.drweb.com
2025-09-25T06:28:08.134848+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:28:08.253640+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:29:38.090842+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:29:38.092114+00:00 vc4-8 update.pl[3220149]: ReloadDaemon(/var/drweb/run/drwebd.pid) has been called ...
2025-09-25T06:29:38.092176+00:00 vc4-8 update.pl[3220149]: ReloadMaild(/var/drweb/run/drweb-maild.pid) has been called ...
2025-09-25T06:29:38.092219+00:00 vc4-8 update.pl[3220149]: ReloadIcapd(/var/drweb/run/drweb_icapd.pid) has been called ...
2025-09-25T06:29:38.092264+00:00 vc4-8 update.pl[3220149]: ReloadLotusd(/var/drweb/run/drweblotusd.pid) has been called ...
2025-09-25T06:29:38.092722+00:00 vc4-8 update.pl[3220149]: Socket path is /var/drweb/run/updateSock#012
 
@chris-design , I got an update from Dr.Web's team. They state that they see a timeout while downloading from update.geo.drweb.com (unfortunately, still don't have an exact IP address ). Considering that the preceding download operation from the same host appears to have completed successfully, this looks like a network issue. They asked if you can replace the update.pl file on your server with the one attached and if possible to provide us with the full log (you can attach it as archive). Thank you again for your cooperation.
 

Attachments

  • updater.zip
    37.2 KB · Views: 0
@Sebahat.hadzhi any updates on this? I am still receiving emails every day...

@chris-design

The updates come from the domain update.geo.drweb.com that has many IPs and most of them are associated with network issues (read: delays).

One IP is performing significantly better, so you can try to solve your issue by adding

85.10.234.30 update.geo.drweb.com

to your /etc/hosts file.

That should do the trick ..........

Kind regards......
 
@chris-design , I got an update from Dr.Web's team. They state that they see a timeout while downloading from update.geo.drweb.com (unfortunately, still don't have an exact IP address ). Considering that the preceding download operation from the same host appears to have completed successfully, this looks like a network issue. They asked if you can replace the update.pl file on your server with the one attached and if possible to provide us with the full log (you can attach it as archive). Thank you again for your cooperation.
@Sebahat.hadzhi Where do you want me to replace the update.pl file?

@chris-design

The updates come from the domain update.geo.drweb.com that has many IPs and most of them are associated with network issues (read: delays).

One IP is performing significantly better, so you can try to solve your issue by adding

85.10.234.30 update.geo.drweb.com

to your /etc/hosts file.

That should do the trick ..........

Kind regards......

@trialotto Thank you very much for that hint! I added the IP to my hosts file and will post an update here if the daily mail from the server has been stopped.
 
@chris-design

The updates come from the domain update.geo.drweb.com that has many IPs and most of them are associated with network issues (read: delays).

One IP is performing significantly better, so you can try to solve your issue by adding

85.10.234.30 update.geo.drweb.com

to your /etc/hosts file.

That should do the trick ..........

Kind regards......
Unfortunately this didn't work. I received a new email this morning:

/etc/cron.daily/drweb-update:
ERROR: Dr.Web Updater: failed to download files !
run-parts: /etc/cron.daily/drweb-update exited with return code 105
 
Back
Top