Intermittent problems downloading DATs from ftp.mcafee.com

[Former Member]

We use "update.sh", as supplied by McAfee, to update our Linux Command Line Scanner.  This goes to ftp.mcafee.com to get "avvdat.ini", and then "avvdat-9606.zip" or whatever today's DAT file is.  Then installs it.

Since the morning (UK time) of 2020-04-29 we've been seeing intermittent problems downloading one or both of the files:

# /usr/local/uvscan/update.sh
Local directory now /tmp/dat-update
update.sh: ERROR: unable to get avvdat.ini file

Or that succeeds, but it fails further on:

# /usr/local/uvscan/update.sh
Local directory now /tmp/dat-update
update.sh: Performing an update (9605.0 -> 9606.0)
Local directory now /tmp/dat-update
update.sh: ERROR: unable to get avvdat-9606.zip file

Success looks like this:

# /usr/local/uvscan/update.sh

Local directory now /tmp/dat-update
update.sh: Performing an update (9605.0 -> 9606.0)
Local directory now /tmp/dat-update
update.sh: DAT update succeeded 9605.0 -> 9606.0
It looks like ftp.mcafee.com resolves as: 

ftp.mcafee.com is an alias for ftp.saasprotection.com.
ftp.saasprotection.com has address 185.125.226.238

Can someone tell me if there's more than one server behind that IP, and they're not in sync, content-wise, please?

I'm having to re-run update.sh multiple times before one will 'catch' and download both files and do the update.

With thanks,

Ben

[Former Member]

https://kc.mcafee.com/corporate/index?page=content&id=KB91260

[Former Member]

I know about this.  But McAfee itself is telling us that's (the update.sh script) the way you download updates for the Linux Command Line Scanner.  If you know of another way that's recommended by McAfee for the Linux Command Line Scanner, please do say.

[Former Member]

Even the latest version of Command Line Scanner (6.1.3) mentions ftp.mcafee.com:

https://docs.mcafee.com/bundle/virusscan-command-line-scanner-v6-1-x-unix-release-notes/resource/pro...

See the bottom of page 5.

[Former Member]

See also page 32/chapter 4 of the product guide:

https://docs.mcafee.com/bundle/virusscan-command-line-scanner-v6-1-x-2020-product/resource/prod-viru...

So what I'm saying is, can ftp.mcafee.com be fixed, please? (-:

[Former Member]

We've edited the update.sh script provided by McAfee in the release notes to repeatedly try downloading via FTP until a valid download is achieved.  If anyone wants this, please let me know by replying to this thread.

[JoeBidgood · Accepted solution]

Apologies for the late reply...

As mentioned above FTP has been retired and DATs should be downloaded from the HTTP site. The release notes you mention haven't been updated, it seems, but there's a knowledgebase article that supersedes them - this also includes a revised update script. The KB can be found at https://kc.mcafee.com/corporate/index?page=content&id=KB67513.

Hopefully this helps 🙂

[Former Member]

Hi Joe,

That's fantastic news and a great relief, even if we had created a working solution which 'elegantly' *cough* repeatedly poked the FTP URL until it gave up the goods.  Thank you for the actual solution.  Can someone explain why the FTP site still exists, then?  And I assume the documentation update is now on someone's To Do list (-:

With thanks,

Ben

[Former Member]

It increments by two for suspicious files when the result data is retrieved from the cache.

[Former Member]

I don't know what you're saying.  What do you mean?  What increments?