Search website:
Home
Products
Download
Buy Now
Support
Company

Help Index

 

If you are having trouble with Avast for linux have a read of the memory access related bugs at the bottom if this page.

Avast Antivirus

How do I install

Currently the Windows and Linux procedures are slightly different:

On Windows (implemented as scanning libraries loaded directly by SurgeMail):

  1. Click install on the common settings page
  2. Wait until installed and updated to latest version (check status on settings page or advanced status page)
  3. Enable SurgeMail integration by ticking the checkbox "Enable Avast integration", press save.
  4. Confirm that it is scanning mail and blocking viruses (by sending in eicar.com as an attachment, or using one of the online virus testing pages: eg. declude.com)

On Linux (implemented as av_avast vpipe scanner that interfaces to the Avast libraries):

  1. Download the Alwil Software Avast linux distribution, uncompress and run ./mkinstall.sh. This may take a while as it downloads the latest virus definition database. Ignore the license related warning, this will be supplied by av_avast.
     
    [root@linux root]# wget ftp://netwinsite.com/pub/surgemail/util/libavastengine-4.7.5-i586.tar.gz
[root@linux root]# ls -l libavastengine-4.7.5-i586.tar.gz
-rw-r--r--    1 root     root     31836499 Mar 15 18:54 libavastengine-4.7.5-i586.tar.gz
[root@linux root]# tar -xzf libavastengine-4.7.5-i586.tar.gz
[root@linux root]# cd libavastengine-4.7.5-i586
[root@linux libavastengine-4.7.5-i586]# ./mkinstall.sh
Copyright(C) 2003-2009 ALWIL Software.  All rights reserved.
the avast! engine for Linux will be installed on this machine
To install 'libavastengine-4.so.7.0.5' library now, press ENTER.
....
The libavastengine-4.so.7.0.5 library installation complete.
***NOTE***: the installation package does not contain a license file.
Any program using this library will not work until you will have a valid
license file (with either a DEMO or a RELEASE license).
[root@linux libavastengine-4.7.5-i586]#
  2. Download NetWin av_avast interfacing binary, uncompress and copy to surgemail directory. 
    [root@linux root]# wget ftp://netwinsite.com/pub/surgemail/util/av_avast_1.4.tgz
[root@linux root]# ls -l av_avast_1.4.tgz
-rw-r--r--    1 root     root       101458 Mar 15 18:40 av_avast_1.4.tgz
[root@linux root]# tar -xzf av_avast_1.4.tgz
[root@linux root]# cp av_avast /usr/local/surgemail
  3. Check that you have avast running (and have the library prerequisites) by running "./av_avast -test" in the SurgeMail directory 
    [root@linux root]# cd /usr/local/surgemail
[root@linux surgemail]# ./av_avast -test
This test will:
 - dynamically load avast libraries (checking dependencies)
 - attempt to scan an infected message
 - attempt to scan a clean message...
Loading avast libraries
Scanning infected email : SUCCESS - Virus detected (EICAR Test-NOT virus!!!)
Scanning clean email    : SUCCESS - Message is clean
Avast installed and working :-)
[root@linux surgemail]#
  4. Enable surgemail integration by adding to surgemail.ini
    - g_virus_filter cmd="av_avast" type=""
    note: if using admin interface you would set "Filter command line" to "av_avast"
    - g_virus_avast "true"
    and optionally
    - g_virus_avast_hour "0,6,12,18"
  5. Restart surgemail
  6. Confirm that it is scanning mail and blocking viruses (by sending in eicar.com as an attachment, or using one of the online virus testing pages: eg. declude.com)

64 bit version on linux

Avast for linux requires the 32 bit compatibility libraries to be installed in order to be able to run on 64 bit servers. Also on some servers the default distribution will segfault as soon as any av_avast command is run. This is due to faults in the linux distributions that do not call the dynamic library initialisation functions correctly. To fix this, install this patch by following these instructions. You need to upgrade the avast binaries and make sure you have av_avast 1.4 and add the "64BITFIX_INIT true" av_avast.ini setting.

Scanning Engine Updates on Linux

On windows the scanning engine is automatically updated with the virus database. On linux this must be done manually periodically. If you are getting errors in the log files along the lines of "vpipe failures 25 in a row av_avast" and / or "Avast initialisation failed, avworkInitialize returned 42000" then you must upgrade the avast engine as described here.

  1. Download the updated Avast linux distribution (ftp://netwinsite.com/pub/surgemail/util/avast4surgemail_linux_engine470b.tar.gz).
  2. Install the distribution by running the ./install.sh script and answering yes to all questions.

Here is a detailed example of this test and upgrade process.

Note: If the avast engine on linux continues to crash for you make sure you are running the 4.7 version of the scannign engine and not the 4.6 version.

To test which version of the scanning engine you are running against on linux, list the following file in your default libraries location:

eg: running against 4.7.0 version of scanning engine:
[root@linux surgemail]# ls -l /usr/lib/libavastengine.so
lrwxrwxrwx 1 root root 25 Jan 10 11:22 /usr/lib/libavastengine.so -> libavastengine-4.so.7.0.0

What do the displayed statistics mean?

	AVAST antivirus blocked 956 of 11723 messages (max concurrent=limited to 1)
		Scanned message  size: av=8.5kb peak=3.1mb  scantime: av=0.0s peak=3.1s
		av_avast version: 1.0
		Avast engine version: unknown
		Avast virus database version: 416-1 (15.04.2004)
		Last update run 0.8 hrs ago SUCCESS(with upgrade)
		Avast scanner uptime 2 days 00:06:42 
		Messages stored as: failed=0 slow=0 (see http://netwinsite.com/surgemail/help/avast.htm)
	Authent module resets  0
	Vpipe scanner restarts 0
	Viruses blocked: g_virus_cmd=0 g_virus_fprot=0 g_vpipe=956

A bunch of statistics are displayed on the behaviour of Avast antivirus. The most important information displayed is the number of messages processed and blocked because they were classified as unwanted (infected, unmonitorable etc). eg: above "blocked 956 of 11723 messages"

In addition you should check that the database is getting regularly updated. The current virus database version is displayed "416-1 (15.04.2004)" and the last time this was updated with the result of the update. The result of the update can be:

  • SUCCESS(with upgrade) - A new virus database update was found and was successfully installed
  • SUCCESS(no upgrade) - A new virus database update was not found
  • FAILED(reason) - The upgrade failed and the reason is displayed. Check log files
  • In Progress - The upgrade is currently in progress
  • (none since startup) - No updates have been run since startup
  • (disabled) - Automatic updates are only run by surgemail if g_virus_avast "true" is set. In addition the frequency can be modified with g_virus_avast_hour.

Further information is available on the performance of your Avast virus scanner. This includes average and peak scan time and message size, the uptime of this vpipe instance of the running scanner. If any problems have been encountered scanning messages these are stored as surgemail/avast/avast_failure_n.msg and avast_slow_n.msg. If you are getting vpipe scanner restarts or any messages stored as failed or many messages stored as slow this should discussed with surgemail-support@netwinsite.com.

 

Avast status warning: n MESSAGES FAILED TO BE SCANNED AND BLOCKED

If you receive this warning on the advanced status page this means that you are running Avast antivirus and an error condition has been encountered that prevented the message from being scanned. The message will have been bounced and stored as avast_failureNN.msg for analysis.

You should first check that you do not have another realtime filesystem level virus scanner installed (such as Norton Antivirus). If you do, you need to prevent the avast temp directory ("_avast4_") from getting scanned. You will find this somewhere in a Windows temp folder like c:\windows\TEMP\_avast4_.

If you have checked the above and continue to receive this error, please report this to surgemail-support@netwinsite.com such that appropriate action can be taken (ie Netwin will report the problem to Alwil software).

Log files

Av_avast logs all information to av_avast.log file. This is a log file that allows different log levels and control of what is logged to this file. To change the av_avast logging behaviour change the av_avast.ini settings. The default av_avast.ini file has an explanation and an example of all configuration settings.

The avast.log and avast.stat are the log files used (for a similar purpose but less control over what was logged) by the version of Avast integrated with SurgeMail on windows.

Notes

Avast is a third party product developed and maintained by ALWIL Software, and is based on ALWIL antivirus technology. We endeavour to resolve any issues in short order by working closely with ALWIL Software but the maintenance of the virus database and actual scanning technology is not under NetWin control and as such NetWin does provide any guarantees on the ability for Avast Antivirus to catch all viruses.

Previously Avast was only available on Windows. Now Avast is available on Windows and Linux. The Linux version is implemented as a vpipe filter. The Windows version was previously run by loading all the Avast dlls into the SurgeMail process.

 

Avast Troubleshooting

Memory access related avast bugs

Recently some people have been experiencing that updates leave linux avast in a state where it will not run. It seems to be changing shared memory requirements mean that in some cases avast will segfault on startup and in other cases will return the error "avworkInitialize returned 22".

If this is happening for you, first try increasing the SHM segments using this command: 

sysctl -w kernel.shmmax=128000000

Also you can try and install this build instead: recent avast engine build.

This build comes direct from Alwil software and has not been modified by Netwin to include the necessary av_avast surgemail interfacing executable (this is already in place in the surgemail directory if you installed the older 4.7 netwin modified avast installer). If you install the above Avast distribution it will install a newer version of the Avast engine, and supply you with a warning regarding memory limits and how to resolve them.

Also in some cases the calls to the avast library surgemail runs to execute the updates fail to be able to replace the installed virus database. If this is happening for you try running avastvpsupdate.pl instead and if necessary add this as a cron job. Let us know on surgemail-support@netwinsite.com if this is happening for you / you continue to have trouble with Avast.

Update issues

If you are having trouble with updates on linux try the following steps to resolve:

  1. Make sure your surgemail upgrades license is uptodate
  2. Try running "./av_avast -update" which is running surgemail's avast upgrade code
  3. Try running "avastvpsupdate.pl" which is running Alwil Software's script to do the same as surgemails update.
In rare cases the script seems to work where running the update via av_avast does not. In this case just add avastvpsupdate.pl as a cron job.

Further Detail on SHM issues

Avast4Linux doesn't work with latest VPS (100328-1 and later)?

Here is advice from Alwil software's website on correcting this:

Starting with the 400.vps, version 100328-1, one of it's internal block reached the inner limit 33554432 bytes. It's a kernel variable which is (quite artificially) limiting the maximum size of any SHM memory block - and 33554432 was a default for some kernels.

Solution? Set the limit to higher values (as root): 

From command line type
sysctl -w kernel.shmmax=128000000
OR
echo 128000000 >/proc/sys/kernel/shmmax

Place those lines to /etc/init.d/rcS or equivalent file (it's a bit distribution-specific
- see /etc/inittab, the sysinit runlevel) to have them set automatically (just after boot).

Step by step:

1.- Open terminal
2.- Type: "sudo su" (then introduce your password)
3.- Type: "echo 128000000 >/proc/sys/kernel/shmmax" (this will solve the problem in the current session).
4.- Type: "gedit /etc/init.d/rcS"
5.- Include the line as follows:
    #! /bin/sh
    #
    # rcS
    #
    # Call all S??* scripts in /etc/rcS.d/ in numerical/alphabetical order
    #
    sysctl -w kernel.shmmax=128000000
    exec /etc/init.d/rc S
6.- Save the file and that's all.