RE: [sniffer] Rulebase download script

[Colbeck, Andrew]

Title: Message

Thanks, Bill.  Yup, the 3rd possibility was the problem, i.e. my version of wget didn't work.  I was using the "official" version from http://www.gnu.org/wget which is 2 years out of date. The current version is really at: http://wget.sunsite.dk/ and so I now have a 1.9.+ version working happily (from April of this year).

 

After I worked that out and added gunzip, my script has grown quite close to yours.  Oh, well, I learned stuff.

 

Posting it here for posterity, and for thems in the cheap seats.

 

Andrew 8)

-----Original Message-----
From: Landry William [mailto:[EMAIL PROTECTED]
Sent: Sunday, October 31, 2004 11:11 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [sniffer] Rulebase download script

Andrew, the compression of the rulebase files is not an issue on the Sniffer server end, because it is working fine for me.  My uncompressed rulebase files are about 14mb, but compress down to just under 4mb before the download.  I am use using GNU Wget 1.9.1, so you might try this version or see if there is an updated version of the wget that you are using.

 

Bill

-----Original Message-----
From: Colbeck, Andrew [mailto:[EMAIL PROTECTED]
Sent: Saturday, October 30, 2004 5:25 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [sniffer] Rulebase download script

Bill, you the man!

 

I was just polishing my own script based on comments made by you and Bonno at the end of the week!  My modest efforts are attached as a .txt file.

 

A few comments from my own efforts:

 

The wget compress option to save me and Pete some bandwidth isn't working for me.  I don't know if the problems lies in my Win32 wget or in Pete's webserver options.  If it's Pete's server, then your gzip is happy to find no compressed file, and return you the original format.

 

My script checks the result file (your snfupd.txt) and skips the replace step if the download was skipped or errored out.

 

My script rotates the Sniffer log before quitting.

 

I'm including it for posterity, and to help the folks in the cheap seats.  I haven't bothered with variables.

 

Andrew 8)

 

p.s. Instead of Scheduled Tasks, I use the "AT" command from the command line so that the update runs as the SYSTEM account; I'd rather have multiple AT commands than remember to change the password on an account and all of it's Scheduled Tasks.

-----Original Message-----
From: Landry William [mailto:[EMAIL PROTECTED]
Sent: Saturday, October 30, 2004 4:48 PM
To: '[EMAIL PROTECTED]'
Subject: [sniffer] Rulebase download script

Attached is an updated rulebase download script for Windows environments that includes variable usage, better comments, gzip compression via wget, new file testing before download, and the ability to e-mail yourself the script results, if desired.  This script has been compiled from suggestions to this list and from my own script.

You will need to rename the script file from ".txt" to ".cmd" in order to use (used ".txt" in order to bypass filter rules and virus scanners).  You can then schedule the script to run via "Scheduled Tasks"

Enjoy!

Bill

<<snfupd.zip>>

------------------------------------------------------------------------------- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to [EMAIL PROTECTED] Thank you

------------------------------------------------------------------------------- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to [EMAIL PROTECTED] Thank you

@REM This file is C:\Utils\UpdateSniffer.cmd
@REM AC July-06-2003
@REM The purpose is to truncate the MailSniffer log and fetch a fresh copy of the
@REM spam signatures rulebase.
@REM Dependencies:
@REM   wget.exe package (free) from http://wget.sunsite.dk/ (not http://www.gnu.org 
which is old!)
@REM   gunzip.exe (free) from http://www.gnu.org
@REM
@REM Oct-31-2004 AC updated to incorporate .gz compression when a download is made
@REM                a big thanks to Bill Landry for a working example!
@REM Oct-30-2004 AC updated to skip the download with wget -N if it is a duplicate of 
a previous download
@REM                and also to skip the update if the download was a duplicate
@REM Sep-07-2004 AC updated to make use of the sniffer check executable

REM @echo off
d:
cd \mailsniffer
exit
if exist wgetresult.txt del wgetresult.txt
if exist snfrv2r3.new.gz del snfrv2r3.new.gz
REM Use the -N parameter to only download a newer file; note that it compares the web 
file with
REM the same name in our directory, our live sniffer rulebase
REM Note the use of the gzip encoding

wget --tries=10 --wait=5 --random-wait --directory-prefix=d:\mailsniffer -o 
wgetresult.txt --header=Accept-Encoding:gzip -N 
http://www.sortmonster.com/MessageSniffer/Demo/snfrv2r3.snf -O snfrv2r3.new.gz

REM If we didn't get the file, at least rotate the log file before quitting

if errorlevel 1 goto logrot

REM The next 3 lines below are not needed anymore, as gunzip deletes the temp file 
anyway
REM Ok, we got the file, but is it fresh? Quit if it is the same as last time
REM fgrep "Server file no newer than local file" d:\mailsniffer\wgetresult.txt
REM if not errorlevel 1 goto logrot

REM Unzip the compressed file; gunzip will automatically hack off the extension,
REM creating snfrv2r3.new and will delete the .gz file too
if exist d:\mailsniffer\snfrv2r3.new.gz gunzip -d -f -v snfrv2r3.new.gz

REM However, sometimes wget downloads a zero length file, in which case the gunzip 
fails
if errorlevel 1 goto logrot
if not exist d:\mailsniffer\snfrv2r3.new goto logrot

REM Check the file for validity, and at least rotate the log file before quitting

snf2check.exe d:\mailsniffer\snfrv2r3.new xnk05x5vmipeaof7
if errorlevel 1 goto logrot

REM If we are here, the file was downloaded, was new, and checked out fine.

if exist snfrv2r3.snf.bak del snfrv2r3.snf.bak
ren snfrv2r3.snf snfrv2r3.snf.bak

:doreplace
ren snfrv2r3.new snfrv2r3.snf
if not errorlevel 0 goto doreplace

REM We send a "snfrv2r3 reload" here, although it checks every ten minutes anyway
snfrv2r3.exe reload

:logrot
snfrv2r3.exe rotate

:quit