Avast Clients Consuming a LOT of Bandwidth

[REDACTED]

Today our Internet connection is maxed out due to our Avast clients constantly pulling data from various subdomains of iavs5x.u.avast.com.  I am not sure why they are doing this.  Any ideas?

[Eddy]

Likely it is a new VPS release (merger of the avg and avast signature database)

[REDACTED]

We are actually having a problem with Avast too. We have more bandwidth so it's not crippling us right now but it's not good.

Monday Avast.com = ~100 MB
Tuesday Avast.com = 10 GB
Today (Wed.) Avast.com = 180 GB (and counting)

Something is definitely messed up!

I hope they get it fixed soon.
-Eric

[.: Mac :.]

Warsaw / Eric,

Are you using a on-premise console and Mirror or the Cloud based Console?

Mac

[REDACTED]

I am using the avast! Enterprise Administration Console Build 8.0.378 as a mirror.  A total of 96.6 GB of data was transferred from our network to avast.com yesterday, and I even had it blocked from 11:30 am CST to 4:00 pm CST.  I've never seen this problem before.  So far today, things appear to be calm, and I do not see much traffic going to avast.com. . . .

[REDACTED]

On-Premise AEA Console. Clients set to receive updates through local mirror. The traffic seems to be coming from all of the clients and not just from the mirror server.
I have Avast.com blocked right now until things get resolved because it was affecting our classes.

Below is a snippit of our server log:
[2016/12/15 13:56:32.659,5020] Removing socket 0x0000054C after MSG_DISCONNECT
[2016/12/15 13:56:32.659,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:35.170,2868] Some client requests connection...
Last message repeated 2 time(s)
[2016/12/15 13:56:36.730,5020] Removing socket 0x00000454 after MSG_DISCONNECT
[2016/12/15 13:56:36.730,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:38.727,5584] Engine is not handled, probably out of licenses...
[2016/12/15 13:56:38.727,5584] sqlFreeConnection with fReturnToPool=false (error handler)
[2016/12/15 13:56:38.727,5584] SQL Server connection has been destroyed...
[2016/12/15 13:56:38.774,5584] New connection to SQL server has been created...
[2016/12/15 13:56:38.774,5584] Engine is not handled, probably out of licenses...
[2016/12/15 13:56:38.774,5584] sqlFreeConnection with fReturnToPool=false (error handler)
[2016/12/15 13:56:38.774,5584] SQL Server connection has been destroyed...
[2016/12/15 13:56:38.789,5584] New connection to SQL server has been created...
[2016/12/15 13:56:38.789,5584] Engine is not handled, probably out of licenses...
[2016/12/15 13:56:38.789,5584] sqlFreeConnection with fReturnToPool=false (error handler)
[2016/12/15 13:56:38.789,5584] SQL Server connection has been destroyed...
[2016/12/15 13:56:40.724,5020] Removing socket 0x0000054C after MSG_DISCONNECT
[2016/12/15 13:56:40.724,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:40.817,5020] Removing socket 0x00000414 after MSG_DISCONNECT
[2016/12/15 13:56:40.817,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:40.895,5020] Removing socket 0x00000418 after MSG_DISCONNECT
[2016/12/15 13:56:40.895,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:40.895,5020] pThis->m_dwFree >= FD_SETSIZE
[2016/12/15 13:56:40.895,5020] Terminating listener loop
[2016/12/15 13:56:40.895,5020] Quiting CListener::Listener() thread with 0x00000000 error code...
[2016/12/15 13:56:40.895,5020] Destroying handle to listener thread
[2016/12/15 13:56:41.722,2868] Some client requests connection...
Last message repeated 1 time(s)
[2016/12/15 13:56:43.735,5584] New connection to SQL server has been created...
[2016/12/15 13:56:45.747,3800] Removing socket 0x00000444 after MSG_DISCONNECT
[2016/12/15 13:56:45.747,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:47.837,3800] Removing socket 0x00000414 after MSG_DISCONNECT
[2016/12/15 13:56:47.837,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:47.837,3800] pThis->m_dwFree >= FD_SETSIZE
[2016/12/15 13:56:47.837,3800] Terminating listener loop
[2016/12/15 13:56:47.837,3800] Quiting CListener::Listener() thread with 0x00000000 error code...
[2016/12/15 13:56:47.837,3800] Destroying handle to listener thread
[2016/12/15 13:56:54.062,2868] Some client requests connection...
[2016/12/15 13:56:58.071,5936] Removing socket 0x00000324 after MSG_DISCONNECT
[2016/12/15 13:56:58.071,5584] MSG_DISCONNECT processing...
[2016/12/15 13:56:58.071,5936] pThis->m_dwFree >= FD_SETSIZE
[2016/12/15 13:56:58.071,5936] Terminating listener loop
[2016/12/15 13:56:58.071,5936] Quiting CListener::Listener() thread with 0x00000000 error code...
[2016/12/15 13:56:58.071,5936] Destroying handle to listener thread
[2016/12/15 13:56:59.896,2868] Some client requests connection...
Last message repeated 2 time(s)
[2016/12/15 13:57:03.906,4220] MSG_DISCONNECT processing...
[2016/12/15 13:57:03.906,4336] Removing socket 0x00000590 after MSG_DISCONNECT
[2016/12/15 13:57:04.779,2868] Some client requests connection...
[2016/12/15 13:57:05.918,4336] Removing socket 0x0000054C after MSG_DISCONNECT
[2016/12/15 13:57:05.918,4220] MSG_DISCONNECT processing...
[2016/12/15 13:57:06.714,2868] Some client requests connection...
[2016/12/15 13:57:07.915,4336] Removing socket 0x00000444 after MSG_DISCONNECT
[2016/12/15 13:57:07.915,4220] MSG_DISCONNECT processing...
[2016/12/15 13:57:09.007,2868] Some client requests connection...
[2016/12/15 13:57:09.927,5584] Engine is not handled, probably out of licenses...
[2016/12/15 13:57:09.927,5584] sqlFreeConnection with fReturnToPool=false (error handler)
[2016/12/15 13:57:09.927,5584] SQL Server connection has been destroyed...
[2016/12/15 13:57:09.943,4336] Removing socket 0x00000590 after MSG_DISCONNECT
[2016/12/15 13:57:09.943,5584] MSG_DISCONNECT processing...
[2016/12/15 13:57:10.738,1796] Going to delete expired requests....
[2016/12/15 13:57:10.738,1796] New connection to SQL server has been created...
[2016/12/15 13:57:11.752,1796] Closing handle to previous flushing thread...

[.: Mac :.]

I am using the avast! Enterprise Administration Console Build 8.0.378 as a mirror.  A total of 96.6 GB of data was transferred from our network to avast.com yesterday, and I even had it blocked from 11:30 am CST to 4:00 pm CST.  I've never seen this problem before.  So far today, things appear to be calm, and I do not see much traffic going to avast.com. . . .

In this case, I would suspect some issue with the streaming updates, but thats just a guess. Ive checked several sites I manage and do not see the same behavior