Plesk Premium antivirus sends a lot of notifications: Your virus bases are obsolete

Symptoms

• Plesk Premium antivirus (Dr.Web) sends too frequent email notifications such as:

  Your virus bases are obsolete.
  Dear Administrator, your virus bases are not up to date. Please run updating script manually or use cron for this purpose

• The extension was recently updated:

  # plesk bin action-log --show -since 2023-07-24 -until 2023-07-31 | grep premium-av
  127.0.0.1 admin [2023-07-25 03:19:55] 'Upgrade extension' ('Extension Id': 'premium-av' => 'premium-av', 'Extension Name': 'Premium Anti-Virus for Servers' => 'Premium Antivirus for Servers', 'Extension Release': '15' => '1', 'Extension Version': '1.0.1' => '1.0.2')

• The following errors can be found in /var/log/messages log :

  Jul 25 09:50:22 hostname drwebd: Interface binding error (/var/drweb/run/.daemon - Address already in use)!
  Jul 25 09:50:22 hostname drwebd: Interface binding error (127.0.0.1:3000 - Address already in use)!

• The drwebd.service has entered restart loop:

  # systemctl status drwebd.service | grep "Active:"
  Active: activating (auto-restart) (Result: exit-code) since Thu 2023-07-25 11:15:05 UTC; 2s ago

Cause

This is a one time problem caused by the Plesk bug ID PPPM-14075: "After update to extension version to 1.0.2, drwebd.service enters a restart loop and sends a lot of notifications".

Fixed in:

• Premium Antivirus for Servers version 1.0.2-2 26 July 2023

Resolution

Please consider updating your server:

• Update the extension Premium Antivirus for Servers

If an extension update is not possible for some reason, as a workaround: