Hello, everyone. Our team got in touch with Dr. Web. At this point, Dr. Web is still reviewing the matter and I cannot confirm what actions will be taken. The only workaround, we can suggest is still changing the update server.
@Tjerk VisserThis last week i didn't recieved any error emails. Dr Web resolved the matter?
And maybe change the time, or that poor server will be DDoSed by all the plesk installations ...The best thing to do is still forcing the IP 85.10.234.30 for updates.
@mow,And maybe change the time, or that poor server will be DDoSed by all the plesk installations ...
Also, can you please edit the logging verbosity in/etc/drweb/drweb32.ini
and set it toDebug
:
Bash:# grep -i loglevel /etc/drweb/drweb32.ini # LogLevel = {Quiet|Error|Warning|Info|Verbose|Debug} LogLevel = Info
Thank you @Sebahat.hadzhi. I just updated the drweb32.ini on one of my servers and set it to Debug.@chris-design , there is still no clarity on the reason for the issue. According to the escalation to Dr. Web and their engineers debug mode should be enabled to gather more details in order to identify the issue:
2025-09-25T06:25:07.993282+00:00 vc4-8 update.pl[3220149]: Dr.Web Updater ($Id: fbb3ca1734c5e75ae3008acef02c2f1032ac44cf $) script path is /opt/drweb/update.pl
2025-09-25T06:25:07.993495+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<workingdir> value=</var/drweb/updater/>)
[shortened]
2025-09-25T06:25:07.995533+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<user> value=<drweb>)
2025-09-25T06:25:07.995572+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<pidfile> value=</var/drweb/run/drwebd.pid>)
2025-09-25T06:25:07.995604+00:00 vc4-8 update.pl[3220149]: ParseStdLine return(name=<mailcommand> value=</usr/sbin/sendmail -i -bm -f drweb -- root>)
2025-09-25T06:25:08.007044+00:00 vc4-8 update.pl[3220149]: Path to bases : /var/drweb/bases/
[shortened]
2025-09-25T06:25:08.007531+00:00 vc4-8 update.pl[3220149]: Path to file about last update: /var/drweb/updater/last_try_cache
2025-09-25T06:25:08.007706+00:00 vc4-8 update.pl[3220149]: Path to lzma: \/opt\/drweb\/lzma
2025-09-25T06:25:08.008302+00:00 vc4-8 update.pl[3220149]: Name(blacklistpath) Value(/var/drweb/dws)
[shortened]
2025-09-25T06:25:08.012987+00:00 vc4-8 update.pl[3220149]: Creating path '/var/drweb/updater/drweb/'...
2025-09-25T06:25:08.041661+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwm11010.vdb, 3357698259, 1686044095) has been called
[shortened]
2025-09-25T06:25:08.048353+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwf11000.vdb, 1902611511, 1686044095) has been called
2025-09-25T06:25:08.048458+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/drwtoday.vdb, 709422280, 1686044095) has been called
2025-09-25T06:25:08.048535+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/dwm11025.vdb, 2654076607, 1686044096) has been called
2025-09-25T06:25:08.048626+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/bases/drw11002.vdb, 3441877724, 1686044089) has been called
2025-09-25T06:25:08.048870+00:00 vc4-8 update.pl[3220149]: insertDataIntoCache(/var/drweb/lib/drweb32.dll, 4263071725, 1686044095) has been called
2025-09-25T06:25:08.049060+00:00 vc4-8 update.pl[3220149]: ParseKey(/opt/drweb/drweb32.key) has been called ...
2025-09-25T06:25:08.049178+00:00 vc4-8 update.pl[3220149]: /var/drweb/bases/custom.drl: no such file or no permissions for reading custom URL list
2025-09-25T06:25:08.049234+00:00 vc4-8 update.pl[3220149]: try using Dr.Web URL list (/var/drweb/bases/update.drl)
2025-09-25T06:25:08.049285+00:00 vc4-8 update.pl[3220149]: exec(/opt/drweb/read_signed drl /var/drweb/bases/update.drl) ...
2025-09-25T06:25:08.051076+00:00 vc4-8 update.pl[3220149]: http://update.geo.drweb.com/plesk/1100/unix
2025-09-25T06:25:08.051478+00:00 vc4-8 update.pl[3220149]: Generating path: component 'drweb', id 'lock'
2025-09-25T06:25:08.051532+00:00 vc4-8 update.pl[3220149]: Generated file path: /var/drweb/updater/drweb/lock
2025-09-25T06:25:08.051637+00:00 vc4-8 update.pl[3220149]: Attempting to fetch http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst ...
2025-09-25T06:25:08.060908+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:25:08.171253+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:25:08.171394+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst.lzma
2025-09-25T06:25:08.171574+00:00 vc4-8 update.pl[3220149]: GET /plesk/1100/unix/drweb32.lst.lzma?m=e52ee6293550298ec4d7e5c57ade18e5 HTTP/1.0
2025-09-25T06:25:08.171629+00:00 vc4-8 update.pl[3220149]: Host: update.geo.drweb.com
2025-09-25T06:25:08.171931+00:00 vc4-8 update.pl[3220149]: request with 373 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.281978+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:25:08.282173+00:00 vc4-8 update.pl[3220149]: Forking decoder: \/opt\/drweb\/lzma d -si -so 2>/dev/null
2025-09-25T06:25:08.290196+00:00 vc4-8 update.pl[3220149]: 6550 bytes received from http://update.geo.drweb.com/plesk/1100/unix/drweb32.lst.
2025-09-25T06:25:08.290279+00:00 vc4-8 update.pl[3220149]: using http://update.geo.drweb.com/plesk/1100/unix for downloading updates ...
2025-09-25T06:25:08.292738+00:00 vc4-8 update.pl[3220149]: UpdateLine: +drweb32.dll, B21ED6A4
2025-09-25T06:25:08.292822+00:00 vc4-8 update.pl[3220149]: UpdateTask: operation = +, file = drweb32.dll, check sum = B21ED6A4, API = , platform =
2025-09-25T06:25:08.292895+00:00 vc4-8 update.pl[3220149]: UpdateLine: +drwebase.vdb, 4096E830
2025-09-25T06:25:08.292972+00:00 vc4-8 update.pl[3220149]: UpdateTask: operation = +, file = drwebase.vdb, check sum = 4096E830, API = , platform =
2025-09-25T06:25:08.336008+00:00 vc4-8 update.pl[3220149]: file = drweb32.dll, check sum = 2988365476
2025-09-25T06:25:08.336056+00:00 vc4-8 update.pl[3220149]: file = drwebase.vdb, check sum = 1083631664
2025-09-25T06:25:08.339729+00:00 vc4-8 update.pl[3220149]: FullPath( drw11000.vdb ) return( /var/drweb/bases/drw11000.vdb )
2025-09-25T06:25:08.339775+00:00 vc4-8 update.pl[3220149]: getCheckSum(/var/drweb/bases/drw11000.vdb) has been called
[shortened]
2025-09-25T06:25:08.377320+00:00 vc4-8 update.pl[3220149]: File '/var/drweb/bases/update.drl' exists, trying to find info about file in cache...
2025-09-25T06:25:08.377540+00:00 vc4-8 update.pl[3220149]: Trying to find info about file 'update.drl' for component 'drweb' in last update cache...
2025-09-25T06:25:08.377592+00:00 vc4-8 update.pl[3220149]: No info about file 'update.drl' for component 'drweb' in last update cache!
2025-09-25T06:25:08.377661+00:00 vc4-8 update.pl[3220149]: http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb will be downloaded to /var/drwe/spool/drw11000.vdb.l6o2VT3A ...
2025-09-25T06:25:08.377970+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb.lzma
2025-09-25T06:25:08.378191+00:00 vc4-8 update.pl[3220149]: Host: update.geo.drweb.com
2025-09-25T06:25:08.378506+00:00 vc4-8 update.pl[3220149]: request with 374 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.528107+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 404 Not Found
2025-09-25T06:25:08.529542+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:25:08.604964+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:25:08.605107+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:25:08.605312+00:00 vc4-8 update.pl[3220149]: Host: update.geo.drweb.com
2025-09-25T06:25:08.605740+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:25:08.681175+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:26:00.015155+00:00 vc4-8 systemd[1]: cron.service: Unit process 3220147 (drweb-update) remains running after unit stopped.
2025-09-25T06:26:00.016404+00:00 vc4-8 systemd[1]: cron.service: Found left-over process 3220147 (drweb-update) in control group while starting unit. Ignoring.
2025-09-25T06:26:38.005984+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:26:38.006788+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:26:38.127900+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:26:38.128016+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:26:38.128233+00:00 vc4-8 update.pl[3220149]: Host: update.geo.drweb.com
2025-09-25T06:26:38.128502+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:26:38.251147+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:28:08.013781+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:28:08.014869+00:00 vc4-8 update.pl[3220149]: Attempting to connect to update.geo.drweb.com ...
2025-09-25T06:28:08.133545+00:00 vc4-8 update.pl[3220149]: Connect to update.geo.drweb.com successful.
2025-09-25T06:28:08.133871+00:00 vc4-8 update.pl[3220149]: Attempting to GET http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:28:08.134344+00:00 vc4-8 update.pl[3220149]: Host: update.geo.drweb.com
2025-09-25T06:28:08.134848+00:00 vc4-8 update.pl[3220149]: request with 369 bytes length was sent to update.geo.drweb.com
2025-09-25T06:28:08.253640+00:00 vc4-8 update.pl[3220149]: update.geo.drweb.com return 200 OK
2025-09-25T06:29:38.090842+00:00 vc4-8 update.pl[3220149]: timeout getting response from http://update.geo.drweb.com/plesk/1100/unix/drw11000.vdb
2025-09-25T06:29:38.092114+00:00 vc4-8 update.pl[3220149]: ReloadDaemon(/var/drweb/run/drwebd.pid) has been called ...
2025-09-25T06:29:38.092176+00:00 vc4-8 update.pl[3220149]: ReloadMaild(/var/drweb/run/drweb-maild.pid) has been called ...
2025-09-25T06:29:38.092219+00:00 vc4-8 update.pl[3220149]: ReloadIcapd(/var/drweb/run/drweb_icapd.pid) has been called ...
2025-09-25T06:29:38.092264+00:00 vc4-8 update.pl[3220149]: ReloadLotusd(/var/drweb/run/drweblotusd.pid) has been called ...
2025-09-25T06:29:38.092722+00:00 vc4-8 update.pl[3220149]: Socket path is /var/drweb/run/updateSock#012
update.geo.drweb.com
(unfortunately, still don't have an exact IP address ). Considering that the preceding download operation from the same host appears to have completed successfully, this looks like a network issue. They asked if you can replace the update.pl
file on your server with the one attached and if possible to provide us with the full log (you can attach it as archive). Thank you again for your cooperation.@Sebahat.hadzhi any updates on this? I am still receiving emails every day...
@Sebahat.hadzhi Where do you want me to replace the update.pl file?@chris-design , I got an update from Dr.Web's team. They state that they see a timeout while downloading fromupdate.geo.drweb.com
(unfortunately, still don't have an exact IP address ). Considering that the preceding download operation from the same host appears to have completed successfully, this looks like a network issue. They asked if you can replace theupdate.pl
file on your server with the one attached and if possible to provide us with the full log (you can attach it as archive). Thank you again for your cooperation.
@chris-design
The updates come from the domain update.geo.drweb.com that has many IPs and most of them are associated with network issues (read: delays).
One IP is performing significantly better, so you can try to solve your issue by adding
85.10.234.30 update.geo.drweb.com
to your /etc/hosts file.
That should do the trick ..........
Kind regards......
/opt/drweb/update.pl
.Unfortunately this didn't work. I received a new email this morning:@chris-design
The updates come from the domain update.geo.drweb.com that has many IPs and most of them are associated with network issues (read: delays).
One IP is performing significantly better, so you can try to solve your issue by adding
85.10.234.30 update.geo.drweb.com
to your /etc/hosts file.
That should do the trick ..........
Kind regards......