appinfo

Purpose: Output information about active Dr.Web Mail Security Suite components.

The following information is output for each running component:

•internally used name;

•GNU/Linux process identifier (PID);

•state (running, stopped and so on);

•error code, if the component has been terminated owing to an error;

•additional information (optional);

For the configuration daemon (drweb-configd), the following is output as additional information:

•the list of installed components—Installed;

•the list of components which must be run by the configuration daemon—Should run.

Arguments: None.

Options

-f [--Follow]—wait for new messages on module status change and display them once such a message is received (CTRL+C interrupts waiting)

baseinfo

Purpose: Display the information on the current version of the scan engine and status of virus databases.

The following information is displayed:

•version of the scan engine;

•release date and time of the virus databases being used;

•the number of available threat records;

•the time of the last successful update of the virus databases and of the scan engine;

•the time of the next scheduled automatic update.

Arguments: None.

Options

-l [--List]—display the full list of loaded files of virus databases and a number of threat records in each file

certificate

Purpose: Display contents of the trusted Dr.Web certificate used by Dr.Web Mail Security Suite to scan protected connections if this option is enabled in settings. To save the certificate in the <cert_name>.pem file, run the command:

Arguments: None.

Options: None

events

Purpose: Display Dr.Web Mail Security Suite events. In addition, this command allows you to manage the events (mark them as read or delete them).

Arguments: None.

Options

--Report <type>—type of the event report.

Allowed values:

•BRIEF—brief report;

•DEBUG—detailed report;

•JSON—serialized report in the JSON format.

-f [--Follow]—wait for new events and display them upon their occurrence (CTRL+C interrupts waiting).

--ShowSeen—display already read events as well;

-s [--Since] <date, time>—show the events that occurred before the specified timestamp (<date, time> is specified as "YYYY-MM-DD hh:mm:ss").

-u [--Until] <date, time>—show the events that occurred no later than the specified timestamp (<date, time> is specified as "YYYY-MM-DD hh:mm:ss").

-t [--Types] <type list>—show the events of the specified types only (types are comma-separated).

The following event types are available:

•Mail—threat detection in an email message;

•UnexpectedAppTermination—unexpected component shutdown.

To view all types of events, use All.

--Show <list of events>—display the listed events (event identifiers are comma-separated);

--Delete <list of events>—remove the listed events (event identifiers are comma-separated);

--MarkAsSeen <list of events>—mark the listed events as read (event identifiers are comma-separated).

If you want to mark as “read” or delete all events, specify All instead of <events list>. For example, the command

will mark all existing events as “read”

report <type>

Purpose: Create a report on Dr.Web Mail Security Suite events in the HTML format (the page body is output to the specified file).

Arguments

<type>—event type that required reporting (indicate one type). See allowed values in the --Types option description of the events command. A mandatory argument.

Options

-o [--Output] <path to file>—save the report to the specified file. The option is mandatory.

-s [--Since] <date, time>—report events that occurred no earlier than the specified timestamp (<date, time> is specified as "YYYY-MM-DD hh:mm:ss").

-u [--Until] <date, time>—report events that occurred no later than the specified timestamp (<date, time> is specified as "YYYY-MM-DD hh:mm:ss").

--TemplateDir <path to directory>—path to the directory that contains HTML report templates.

Options -s, -u, and --TemplateDir are not mandatory. For example, the command:

generates a report on all existing email message threat detection events, based on the default template, and saves the result in the report.html file in the current directory.

idpass <identifier>

Purpose: Display the password generated by the email scanning component Dr.Web MailD for an email message with the indicated identifier and used for the protection of an enclosed archive with threats removed from the email message (i.e. if RepackPassword parameter was set in the component settings to HMAC(<secret>)).

Arguments

<identifier>—identifier of an email message.

Options

-s [--Secret] <secret>—secret word used for the generation of the archive password.

If a secret word is not indicated when the command is called, the current secret word <secret> is used. It is indicated in the Dr.Web MailD settings. If the RepackPassword parameter is not available or set to a value different from HMAC(<secret>), the command will return an error.

license

Purpose: Display the information about the currently active license, get a demo-version license, or get the key file for a license that has already been registered (for example, that has been registered on the company website).

If no options are specified, then the following information is output (if you are using a license for the standalone mode):

•a license number,

•date and time when the license expires.

If you are using a license provided to you by a centralized protection server (for the use of the product in the centralized protection mode or mobile mode), the corresponding message is output.

Arguments: None.

Options

--GetDemo—request a demo key that is valid for one month and receive this key, if the conditions for the provision of a demo period have not been violated.

--GetRegistered <serial number>—get a license key file for the specified serial number, if the conditions for the provision of a new key file have not been breached (for example, breached by using the product not in centralized protection mode, when the license is managed by a centralized protection server).

--NetworkTimeout <time interval>—timeout in milliseconds for network operations during the use of the license command. This parameter is used to continue activation when the connection is temporarily lost. If the connection is re-established before the timeout expires, the activation will be resumed. If 0 is specified, then there is no timeout.

Default value: 0.

--Proxy http://<username>:<password>@<server address>:<port>—get a license key via the proxy server (used only with one of the previously mentioned options—--GetDemo or --GetRegistered).

If the serial number is not the one provided for a demo period, you must first register this number at the company website.

For further information about licensing Dr.Web products, refer to the Licensing section.

log

Purpose: Display the latest log records of Dr.Web Mail Security Suite in the console (the stdout stream, similar to the tail command).

Arguments: None.

Options

-s [--Size] <number>—number of the latest log records to be displayed on the screen.

-c [--Components] <components list>—list of component identifiers whose records are displayed. Identifiers are space-separated. If no argument is defined, all available records logged by all components are displayed.

Actual identifiers of the installed components (e.g. internal component names displayed in the log) can be displayed using the appinfo command.

-f [--Follow]—wait for new log records and display them once they are received (CTRL+C interrupts waiting).

stat

Purpose: Display statistics about the operation of components that process files or about the operation of the network data scanning agent Dr.Web Network Checker (press CTRL+C or Q to interrupt displaying the statistics).

The statistics output includes:

•a name of the component that initiated file scanning;

•component PID;

•an average number of files processed per second during the last minute, 5 minutes, 15 minutes;

•a percentage of using the cache of the scanned files;

•an average number of scan errors per second.

For the distributed scanning agent, the following information is displayed:

•a list of local clients that initiated scanning;

•a list of remote hosts that received files for scanning;

•a list of remote hosts that sent files for scanning.

For local clients of the distributed scanning agent, their PID and name are specified; for remote clients—an address and port of the host.

For both clients—local and remote—the following information is displayed:

•an average number of files scanned per second;

•an average number of sent and received bytes per second;

•an average number of errors per second.

Arguments: None.

Options

-n [--Netcheck]—display statistics on operation of the network data scanning agent

lookup <type>@<tag>[@<template>]

Purpose: Verify data source connection settings.

Arguments

<type>—data source type. The following values are allowed: ldap, ad, pq, sqlite, mysql, redis, allmatch, regex, cidr, mask. These types are characterized in the description of Dr.Web LookupD settings.

<tag>—data source identifier. For example, if the [LookupD.LDAP.auth1] section is created in the unified configuration file, auth1 will be an identifier of a data source of the LDAP type.

<template>—template (string) to search in a data source. Optional argument. If the template is set, a search for it is performed and the true value (found) or the false value (not found) is returned.

Options

--User <user name>—user name to connect to the data source;

--Domain <domain name>—domain name to connect to the data source.

-d [--Debug]—display debug information.

Examples