Every morning I get one email from my servers. It tells me what updated overnight, what looks unhealthy, and whether the virus scanner found anything. For months, that last line said the same thing: nothing found. I took it as good news.
It was not good news. It was a scanner that had stopped learning. A virus scanner works by comparing your files against a list of known threats, and that list changes every day. On the small server that hosts my websites, the part that downloads the daily list had been switched off since April. The scanner kept running every night and kept reporting "clean," while checking against a list that got older every day.
No off-the-shelf alert caught this, because nothing had technically failed. The scanner ran. The report arrived. The only clue was a date buried in the scanner's own files, and nobody reads that date unless something makes them go looking.
How the System Works
Now the nightly report checks the scanner itself, not just what the scanner says.
- Fresh List Every Night: The threat list updates automatically on both of my servers before the nightly scan starts, so every scan uses that day's list.
- Checks Its Own Age: If the list on either server is more than three days old, the report flags it as a problem instead of quietly saying "clean."
- Every File, Every Week: The scan of uploaded files (photos, documents, anything a website visitor or editor added) works through one slice of the files each night, so every file is covered at least once a week.
- One Email: All of it lands in the same morning report I already read, so there is nothing new to remember.
Overcoming the Friction
1. The Second Server Had the Same Problem in Disguise
Once I found the stale list on the web server, I checked my other server, expecting it to be fine. Its list was current. But the scanner there was quietly skipping the newest part of that list, because the file was locked away from the account doing the scanning. It ran with about 3.3 million known threats when it should have had 3.6 million, and it said nothing about it, because its error messages were going nowhere. I gave the scan the access it needed, and any scanner error now shows up in the morning report instead of disappearing.
2. A Scan That Never Finished
Months earlier, the websites' upload folders had grown to nearly 3 GB of product photos. The nightly scan was given ten minutes and never once got through all of them. For two weeks the report said "did not finish," which is easy to skim past. Now each night covers the files that changed in the last few days, plus one-seventh of everything else, so the whole collection gets checked every week without ever running out of time.
The Business Win
The fix took an afternoon and cost nothing. Both servers now scan against the full, current threat list every night, and every uploaded file gets checked weekly instead of never. The biggest change is that the report can no longer say "all clear" when the scanner itself is broken.
If you have a security tool that has said "nothing found" for a long time, check when it last updated. That is the question I should have asked in April. Next, I am reading the reports that show who is sending email as my domains, so I can tell the world to reject the fakes.
Top comments (0)