Issue Plesk Premium Antivirus doesn't start (after Plesk 18.0.31 Update #2)

[DieterWerner]

/usr/local/psa/admin/bin/drwebmng --start
/usr/local/psa/admin/bin/drwebmng[6597]: Unable to start drweb antivirus daemon

 

[Aytalina]

Hello,

Could you please provide us with some additional details regarding the issue:

- Operation system (you can execute 'plesk version' command)
- The output of Plesk log.

To generate a detailed output:

- Try to enable debug logging in Plesk if applicable. You can use How to enable/disable Plesk debug mode if applicable
- Reproduce the issue (start Plesk Premium Antivirus service from Tools&Settings > Services Management)
- Check /var/log/plesk/panel.log

Some additional actions might also be helpful:

- Try to manually start drweb using a command described in Unable to start Plesk Premium Antivirus ( Dr.Web ) on Plesk server
- Try to check the latest entries in drwebd logs using 'journalctl -u drwebd'

Thank you.

 

[DieterWerner]

OS: Centos 7
Plesk.log: what's the path?
journalctl -u drwebd (last entry):
Okt 08 12:49:40 xxxyyyzzz.net drwebd.real[32233]: 127.0.0.1 [32233] /var/spool/drweb/spool/drweb.tmp.Uq7vtS - Ok
Manually start drweb:
/usr/local/psa/admin/bin/drwebmng --start
Result:
/usr/local/psa/admin/bin/drwebmng[6597]: Unable to start drweb antivirus daemon

 

[Aytalina]

DieterWerner,

Please provide the output of the following commands:

service drwebd start

and

plesk bin server_pref --show | grep ssl-protocols

Thank you.

 

[DieterWerner]

/$ service drwebd start:

Starting Dr.Web drwebd...
Dr.Web (R) daemon for Linux/Plesk Edition v6.0.2.1
Copyright (c) Igor Daniloff, 1992-2020
Doctor Web, Moscow, Russia
Support service: Dr.Web — innovative anti-virus technologies. Comprehensive protection from Internet threats.
To purchase: Dr.Web — innovative anti-virus technologies. Comprehensive protection from Internet threats.
Key file: /opt/drweb/drweb32.key - Key file was not found! (No such file or directory)
A path to a valid license key file was not specified.
Plesk authorization failed: malformed response (no 'response=' field).
Error: Plesk Software not running.

/$ plesk bin server_pref --show | grep ssl-protocols:
ssl-protocols: TLSv1.1 TLSv1.2

Edit:
Last night eMails from WatchDog:
04:12 - Plesk wurde erfolgreich aktualisiert
04:16 - PHP-FPM (FastCGI Process Manager) on xxxyyyzzz.net is down
04:21 - Plesk Premium Antivirus on xxxyyyzzz.net is down

 

[Aytalina]

DieterWerner,

Thank you for the information.

Do you have any mailboxes with enabled antivirus on the server? Try to create a mailbox and enable antivirus for it. Then you will be able to start/stop the service without the license key related warnings.

drweb trial mode will be available only if at least one mailbox with drweb is created.

 

[Lukas Beerschwinger]

I have exact the same Problem since the Update.

 

[Aytalina]

Hello,

Please post the output of

/etc/sw-cp-server/conf.d/plesk-drweb-local.conf

and

/etc/sw-cp-server/conf.d/plesk-drweb-local.ipv6.inc

 

[Lukas Beerschwinger]

/etc/sw-cp-server/conf.d/plesk-drweb-local.conf

server {
listen [::1]:8443 ssl;
listen 127.0.0.1:8443 ssl;

ssl_certificate /usr/local/psa/admin/conf/httpsd.pem;
ssl_certificate_key /usr/local/psa/admin/conf/httpsd.pem;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;

include conf.d/*plesk.inc;
include conf.d/*wpb.inc;
}

/etc/sw-cp-server/conf.d/plesk-drweb-local.ipv6.inc -> ipv6 is deactivated, so there's no file

i reinstalled drweb via plesk, checked every "solution" i found in plesk support

 

[DieterWerner]

Do you have any mailboxes with enabled antivirus on the server?

I have more than one mailboxes running and protected by Antivirus.
Today I de- and reinstalled the Antivirus Software and that is (a part) of the installer output:

"Key file: /opt/drweb/drweb32.key - Key file was not found! (No such file or directory)
A path to a valid license key file was not specified.
Plesk authorization failed: malformed response (no 'response=' field).
Error: Plesk Software not running."

 

[Lukas Beerschwinger]

I have more than one mailboxes running and protected by Antivirus.
Today I de- and reinstalled the Antivirus Software and that is (a part) of the installer output:

"Key file: /opt/drweb/drweb32.key - Key file was not found! (No such file or directory)
A path to a valid license key file was not specified.
Plesk authorization failed: malformed response (no 'response=' field).
Error: Plesk Software not running."

yes, same

 

[DieterWerner]

OK
I did an restore to version 18.0.31 Update #1
and everything works fine again.
So the current plesk update was the bad boy (again!)

Let me say it politely:
I am (again) annoyed about updates that contain deteriorations.

See: Issue - Can't receive eMails

 

[Lukas Beerschwinger]

OK
I did an restore to version 18.0.31 Update #1
and everything works fine again.
So the current plesk update was the bad boy (again!)

Let me say it politely:
I am (again) annoyed about updates that contain deteriorations.

How did you restore? Can you please share.

 

[Aytalina]

Hello DieterWerner, Lukas Beerschwinger

I am sorry to hear that you face the issue with Hotfix 2, but do not see it in Hotfix 1.

Based on the information you provided in this thread, it is quite difficult to get to the whole picture of the issue without access to your server. The reason for this is that the configuration file you provided is ok and I suppose that something was initially incorrect. And, as you described, updating to Hotfix 2 just made the initial issue appear again.

Thus, the most important thing here is to find not only a solution to the problem, but the initial root cause so this will not appear in the future again.

The best way to do it is to create a ticket for our Support Team. Please refer to the article available at How to get support directly from Plesk?

The team will check the issue directly on your server and provide you with details about their investigation.

Thank you!

 

[DieterWerner]

he reason for this is that the configuration file you provided is ok and I suppose that something was initially incorrect. And, as you described, updating to Hotfix 2 just made the initial issue appear again.

Thus, the most important thing here is to find not only a solution to the problem, but the initial root cause so this will not appear in the future again.

The best way to do it is to create a ticket for our Support Team. Please refer to the article available at How to get support directly from Plesk?

The team will check the issue directly on your server and provide you with details about their investigation.

Thank you!

Hello DieterWerner, Lukas Beerschwinger

I am sorry to hear that you face the issue with Hotfix 2, but do not see it in Hotfix 1.

Based on the information you provided in this thread, it is quite difficult to get to the whole picture of the issue without access to your server. The reason for this is that the configuration file you provided is ok and I suppose that something was initially incorrect. And, as you described, updating to Hotfix 2 just made the initial issue appear again.

Thus, the most important thing here is to find not only a solution to the problem, but the initial root cause so this will not appear in the future again.

The best way to do it is to create a ticket for our Support Team. Please refer to the article available at How to get support directly from Plesk?

The team will check the issue directly on your server and provide you with details about their investigation.

Thank you!

Not possible because I bought the license from a Plesk partner - the support denied to create a ticket because of my license. Isn't that nice?

How did you restore? Can you please share.

I used my daily backup

 

[Aytalina]

DieterWerner,

You wrote:

Not possible because I bought the license from a Plesk partner - the support denied to create a ticket because of my license. Isn't that nice?

You can create a ticket directly to Plesk Support using a free trial of support subscription.

 

[Lukas Beerschwinger]

With old TLS/SSL Version (https://pleskhostname:8443/modules/sslit/index.php/main-page/index) drweb works..

 

[Lukas Beerschwinger]

drweb works with intermediate: https://statics.tls.security.mozilla.org/server-side-tls-conf-4.0.json

tls_versions
0	"TLSv1.2"
1	"TLSv1.1"
2	"TLSv1"

drweb works not with intermediate, only with "old": https://statics.tls.security.mozilla.org/server-side-tls-conf-5.0.json

tls_versions
0	"TLSv1.2"
1	"TLSv1.3"

Can you (@Aytalina) please give a List, which Services are changed with "SSL It!" synchronisation?

 

[Aytalina]

Hello @Lukas Beerschwinger,

Yes, you are right that drweb works with TLSv1 only.
drweb should work despite the fact that TLSv1.2 (or higher) is used, or the 'intermediate' preset is applied in SSL It!
This is because starting from Obsidian we use separate drweb configuration files which allow drweb to use TLSv1. The files are located in /etc/sw-cp-server/conf.d/plesk-drweb-local.conf and /etc/sw-cp-server/conf.d/plesk-drweb-local.ipv6.inc
However, in some cases, for instance, with upgrades from Onyx these configuration files were not created. Regarding this behavior, I created an internal issue with id PPP-51350, the fix will be included in Plesk Obsidian 18.0.32.

You asked:

Can you (@Aytalina) please give a List, which Services are changed with "SSL It!" synchronisation?

It depends on your current configuration.
To show currently stored services' configuration you can use:

plesk sbin sslmng --show-config

To debug what protocols are applied by SSL It! you can enable the debug mode in Plesk How to enable/disable Plesk debug mode and then enable the preset you need. Check /var/log/plesk/panel.log to find the services applied by 'sslmng' utility.