Files
Linux-Server-Management-Too…/modules/security
cschantz a3ff279665 Fix CRITICAL: ImunifyAV scan detection bug - was scanning 0 files
Problem:
ImunifyAV scans were completing instantly with 0 files scanned because
our monitoring logic was fundamentally broken.

Root Cause:
1. We ran: imunify-antivirus malware on-demand start --path="/" &
2. This command returns IMMEDIATELY (doesn't block)
3. ImunifyAV starts scan asynchronously in its own background process
4. Our shell's $SCAN_PID exits right away (command finished)
5. Monitoring loop: while kill -0 $SCAN_PID exits immediately
6. We read results before scan actually started/finished
7. Result: 0 files scanned, scan marked as "stopped"

Example of broken output:
  ✓ Scanned 0 files
  ⏱  Duration: 7s
  [ImunifyAV scan complete - Found: 0]

This is WRONG - should scan thousands of files!

The Fix:

Changed from monitoring shell PID to monitoring scan STATUS:

OLD (BROKEN):
- imunify-antivirus ... &  # Background the COMMAND
- SCAN_PID=$!
- while kill -0 $SCAN_PID  # Check if command still running
  This fails because command exits immediately!

NEW (FIXED):
- imunify-antivirus ...  # Run in foreground (returns immediately anyway)
- while scan_running:
    - Poll: imunify-antivirus malware on-demand list
    - Check SCAN_STATUS field (running/completed/stopped/failed)
    - Check CREATED timestamp (is this our scan?)
    - Monitor until status = completed/stopped/failed
  This works because we monitor the actual scan, not the command!

Changes Made:

1. Removed & from command execution (line 829)
   - Command returns immediately anyway
   - No need to background it

2. Changed monitoring from PID-based to status-based (lines 846-895)
   - Poll scan list every 3 seconds
   - Check SCAN_STATUS field (field 7)
   - Check CREATED timestamp to identify our scan
   - Exit loop when status changes to terminal state

3. Added proper status handling:
   - completed: Success, read results
   - stopped: Warning, scan incomplete
   - failed: Error, skip this path

4. Added scan stop on timeout (line 892)
   - imunify-antivirus malware on-demand stop --path="$path"
   - Cleanly stops runaway scans

5. Better timestamp validation (line 856)
   - Only monitor scans created after SCAN_START
   - Prevents reading old/wrong scan results

Status Field Values:
- running: Scan in progress
- completed: Scan finished successfully
- stopped: Scan was interrupted/stopped
- failed: Scan encountered error

Impact:
BEFORE: ImunifyAV scanned 0 files (broken)
AFTER: ImunifyAV will properly scan thousands of files

Testing Needed:
- Run full server scan with ImunifyAV
- Verify file count increases during scan
- Verify scan completes with realistic file counts
- Check that progress updates appear
2025-12-22 19:18:26 -05:00
..