The malware scanner on my server reports that the license is invalid. Check
what the license file says, whether the matching service still really
answers and what is in the error log. Do not change anything yet, tell me
what you find first.
On a server with a malware scanner this is the message that makes you skip a heartbeat: License is invalid for current server. The scanner stops working, the daily checks go quiet, and your first thought is that the license expired or sits on the wrong server.
In practice that is often not the case. We ran into this on one of our own servers: the license still existed at the vendor, but the scanner no longer knew it. The cause was on the server, not in the paperwork.
What is really going on
The scanner works with a token that it refreshes regularly. That token is valid for about three days. Refreshing is done by a service on the server that talks to the vendor.
If that service hangs, exactly one thing happens: the token expires. After that the scanner can no longer prove it is allowed to run, so it reports that the license is invalid for this server. From the program's point of view the message is correct, but it points in the wrong direction.
The treacherous part is that it starts quietly. In our case the service had been stuck for two days before the message appeared, because the old token was still valid. So you only see the problem once it has been going on for a while.
The three things you check
All three are read actions. They change nothing, so you can safely let the assistant do them.
1. The license file. The scanner keeps its license state in a file, with the status and two timestamps: when the token was created and when it expires. If the status says fine while the expiry time is in the past, you have your answer. The license is there, the token is old.
2. Does the service still answer? The scanner talks internally over a socket. You can look at how many requests are queued there. If the queue is full, the service is no longer accepting anything. Ours sat at one hundred and one waiting requests with a maximum of one hundred: completely shut.
3. The error log. If it holds line after line saying that refreshing the token failed, with a rising attempt number, that is your proof. The service is trying, but it is not getting anywhere.
A fourth signal that put us on this track: the program itself said the service was stopped, while the system reported the service as active. When those two contradict each other, you are looking at a process that still exists but no longer does anything.
The fix
Restart the service. Not the whole server, just that one service. For us the license status was fine again within a minute and the token had been refreshed.
That is a write action, so in the assistant you get an approval card for it. That is exactly the point: first the three read actions, then one change you know the reason for.
What you do afterwards
Restarting is the fix, but not the whole story. Three things you want to arrange after it.
Set up an alert on the license state. The scanner itself only reports once the token has already expired. Your own check on the expiry time warns you a day earlier. That is exactly the kind of small job you can hand over in plain language:
Check every day whether the malware scanner's token is still valid for at
least 24 hours and whether the service answers. Only email me when
something is wrong, and no more than once a day about the same thing.
Then check whether the daily maintenance jobs on the server still run. A service that hangs rarely hangs alone. In our case a daily job belonging to the scanner had been stuck for two days, which also stalled the whole chain behind it, including log rotation. You do not notice that on the scanner, but you do notice it in your disk space.
And write down that you had this. The next time this message comes by, it saves you half an hour to know that you look at the token first, not at your invoice.
Common mistakes
"The license must have expired, I will buy a new one." Look in the license file first. If the status says fine, there is nothing wrong with your license and a new one fixes nothing.
"The server's hostname is wrong in the license list." That happens, especially with servers that were renamed at some point, and it does make looking things up confusing. But it is not a cause of this message. Search the vendor's license list by IP address instead of by name, and you know for sure whether the license exists.
"I will just reboot the server." That often works, but afterwards you do not know what it was, and you take down every website on that server for a moment. Restarting one service is less invasive and tells you more.
"The scanner reports nothing, so everything is fine." A scanner without a valid token reports nothing at all. Silence is not good news here. Check periodically whether the last scan actually ran, not just whether there are no alerts.
"This could happen to my hosting package too." On shared hosting we manage the scanner and we see this kind of message ourselves. This article is about your own server, where you share the management with us or do it entirely yourself.