Resolved The Dr Web file updater problem

[Kroptokin]

So. I get an email every 30 minutes like this:

ERROR: Dr.Web Updater: key file not found !
See Dr.Web Updater log file for details

My Web host referred me to this article:

https://kb.plesk.com/en/118058

It's actually wrong - the crontab file does not look like the one in the article. Mine (Plesk 12.5.30) looks like this:

#!/bin/sh

update_scr="/opt/drweb/update.pl"

outfile=`mktemp /tmp/drweb-update.XXXXXX`
[ -x "${update_scr}" ] || exit 0

trap 'rm -f $outfile;' TERM INT EXIT

"${update_scr}" >$outfile >/dev/null 2>&1
rc=$?

[ $rc -eq 0 ] || cat $outfile
exit $rc


The /dev/null part 5 lines up from the bottom was added by me based on the out of date article.

I still get the emails.

Does anyone from Plesk know how you stop these?

I find it slightly surprising that the product is shipped in a state where it sends emails which are bound to cause problems (the same problem on my client's server has triggered it seems a Hotmail spam response) and then it is not straightforward to turn them off.

 

[IgorG]

Try this solution at least - #5

 

[Kroptokin]

Running that script - which is run by the daily cron job doesn't fix the problem. I'm not 100% sure why you think it might? Assuming my cron.daily is running it is being run anyway.

Further information:

The script /opt/drweb/update.pl outputs the message:

ERROR: Dr.Web Updater: key file not found !
See Dr.Web Updater log file for details

It is logging to /var/log/messages with this:

Jun 24 00:02:13 vmi71025 update.pl[18505]: Generated file path: /var/drweb/updater/agent/
Jun 24 00:02:13 vmi71025 update.pl[18505]: Generated file path: /var/drweb/updater/drweb/
Jun 24 00:02:13 vmi71025 update.pl[18505]: Trying to load last update cache...
Jun 24 00:02:13 vmi71025 update.pl[18505]: Last update cache has been loaded.
Jun 24 00:02:13 vmi71025 update.pl[18505]: Loading cache data...
Jun 24 00:02:13 vmi71025 update.pl[18505]: Cache file '/var/drweb/updater/cache' is not exists. Can not load cache data!
Jun 24 00:02:13 vmi71025 update.pl[18505]: key file not found
Jun 24 00:02:13 vmi71025 update.pl[18505]: Saving last update cache data...
Jun 24 00:02:13 vmi71025 update.pl[18505]: Last update cache data has been saved.

And looking in the script I find the line that outputs the above message. It is looking for this:

/opt/drweb/drweb32.key

So: this does appear to move us further forwards. A script is looking for that file and it does not exist.

Finally:

https://kb.plesk.com/en/112793

This key is required by Premium Anti-Virus - but only, it seems, if you have more than 14 email accounts. Assuming this doesn't include aliases I don't have more than 14 email accounts.

Do I need to have this key? Is something not working because I don't? If I don't need the key what is causing the emails to be sent about it? - The emails are being sent by the Cron Daemon. Every 30 minutes. (That seems to rule out cron.daily). What cron job might be running these? (The user drweb has no crontab).

Thanks.

Finally; is there a direct support line to Odin?

Thanks.

 

[UFHH01]

Hi Kroptokin,

First, pls. note the following:

Information
Premium Antivirus is the default mail antivirus program shipped with Plesk. If an additional license key for Premium Antivirus is not added to the Plesk license key, only 14 mail accounts are protected.

and

Question
Premium Antivirus that is included for free to any Plesk license, will secure only 14 mail accounts. How does it picks those 14 accounts?

Answer
Premium Antivirus secures random 14 mailboxes in the list of all recipients. There is no permanent list of accounts that will be always protected. Free version of Premium Antivirus should be used on a server with not more than 14 mailboxes. In case there are more mail accounts, consider purchasing Premium Antivirus paid license.

In addition, your error - message ( "ERROR: Dr.Web Updater: key file not found !" ) can be ignored, if you don't have an additional Premium Antivirus licence key and don't want to purchase one.
If you don't like the "key-not-found - notifications", pls. follow:

How can I disable "Dr.Web Updater: key file not found" notifications? ( Plesk knowlegde-base article 118058 )
​

If you experience issues, that the notifications are still sent to you, pls. consider to edit "/etc/drweb/drweb_handler.conf"
From

[VirusNotifications]
SenderNotify = yes
AdminNotify = yes
RcptsNotify = yes

to

[VirusNotifications]
SenderNotify = no
AdminNotify = no
RcptsNotify = no

... and pls. restart DrWeb afterwards, with the command: /etc/init.d/drwebd restart


Consider as well to look out for other possible crontabs from user "drweb":

crontab -u drweb -l​

... and change the possible crontab example with "vi" or "vim" to:

55 2,7,12,17,20 * * * /opt/drweb/update.pl >/dev/null 2>&1​

In some cases, you might as well consider to change the file "/etc/drweb/drweb32.ini"
From

# CronSummary = yes

to

CronSummary = no

And finally, IF the file "/usr/local/psa/etc/drweb-update" exists, pls. consider to change

#!/bin/sh
exec /opt/drweb/update.pl

to

#!/bin/sh
exec /opt/drweb/update.pl >/dev/null 2>&1

 

[Kroptokin]

Thanks UFHH01

I was going to say that must be the definitive answer to this question, but it seems not...

For me the relevant cron job was in:

/etc/cron.d/drweb-update

I had to add >/dev/null 2>&1 to the script in that file - which is running every 30 minutes. Here is the full, fixed, line:

*/30 * * * * drweb /opt/drweb/update.pl >/dev/null 2>&1

This is on:

Plesk 12.5.3 on CentOS 7.2.1511

Hopefully this will make your exhaustive article a little closer to 100% coverage...