why does virus def update download .cav files twice?

[Guest]

[com091230]

nightly virus def auto update hasn't worked since nov23 (was also when updated CIS to v3.13
but don't think its related since have had virus def update problems before that)

told it to use a local proxy (privoxy.org if it matters) so could see whats happening when do
manual update. full log attached

at 09:13:4 it starts by getting BASE_UPD_END_USER_v2980.cav. all goes ok til  09:15:22
when it fails on v3025.cav. & again at 09:15:26 fails on v3028.cav. at 09:16:38 it gets
last file v3082.cav. but then starts to get v2980.cav again. why? & then when it fails to get
v2983.cav (which again it had already got before) it stops all togetther

(really annoying thing is if i try the manual update again, it again starts with v2980.cav even
though it had already got at least upto v3024.cav ok before)

just seems to be something wrong with the way it does reattempts when have fails on
individual .cav files

[EricJH]

Try downloading the latest bases.cav as described in Where can i download the latest full AV database?. Now try updating again.

[com091230]

CIS itself must've downloaded full base 3279.cav file, because now incremental update starts
with 3280.cav. but again it tries to download incremental files twice

in fact (in attached log) it was able to download all (from 3280.cav [at] 14:36:59 to
3336.cav [at] 14:37:58) files correctly & yet it again starts immediately getting 3280.cav
again before giving up after an error

is there some CIS logging that can be enabled to see why it thinks it needs to download
all incremental .cav files twice?

[EricJH]

As far as I understand the logs it is requesting and not downloading anything yet. First request for 3280 is done at us us3 and the second one at the eu1 servers.

[com091230]

got privoxy to use common log format (2nd last number is web server return code, last nbr is
bytes received from server). this shows that CIS is trying to download both times

3280.cav: 4124 bytes from eu2, 7191 from eu1 on 2nd attempt
3281.cav: 2928 bytes from both eu2 & eu1
3282.cav: 0 from eu2, 874 from us3
3283.cav: 2119 from us3 both times
3284.cav: 6902 from eu1 & us3

have used wget to grab these files a few times & does look like 7191, 2928, 874, 2119 & 6902 r the
right sizes for these files

still left with initial impression of something iffy about the way CIS handles file download errors. e.g.
- having got 3280,1,2,3,4 correctly at least once, why does it need to get them again when
  redo a manual update?
- having got 3281,3,4 correctly first time why does it need to get them again?

any way to pass these logs onto a CIS developer? or get info on how to enable CIS to generate
its own log files during update?

[Ronny]

This can happen in the following situtation:

Say the .ini file says latest available DB = 3310
You are on 3280 so you need incremental updates from 3281 to 3310...

The updater tries to downloads all 3281 to 3310 incremental updates, if it fails in between all downloads are "lost" so if you check again it will re-download all 3281 to 3310 again.

Now there is a problem if a missing or failing incremental is in between, like 3301 is missing or won't download for whatever reason... you keep failing updates.

Can you verify what the DB version is on the Misc, About box? after updates to see if it works.

Also if you already experienced trouble with the 3.12 version also i would strongly recommend to download the latest full and follow the procedure posted, there have been changes in file layout that cause incompatibility between versions.

[Tags:]