How to check whether AV engines are running the latest update from the OPSWAT update server?

Overview

This article explains how to confirm that the antivirus (AV) engines on MetaDefender Core are running the latest engine and definition (database) packages published on the OPSWAT update server. Use it when you need to verify update status beyond the engine status shown in the web console, for example after a failed update or when building monitoring and alerting.

The check has two parts:

1. Read what is installed on MetaDefender Core using the Engines Status API.

2. Compare it against the latest packages published by OPSWAT in the MetaDescriptor file.

Prerequisites

• A MetaDefender Core API key (or session ID) with permission to call GET /stat/engines.

• Network access to update.dl.opswat.com from the machine where you download the MetaDescriptor file. In offline environments, download the file on an internet-connected machine.

Steps

Step 1: Check the installed packages with GET /stat/engines

1. Call GET /stat/engines on MetaDefender Core (see the Engines Status API documentation). For example:

2. For each engine, note these fields:

   • def_time — the timestamp of the definition (database) package currently installed.

   • download_time — the time MetaDefender Core downloaded the engine package. This is not the download time of the definition package, which is updated more often than the engine itself.

   • eng_ver — the version of the engine package currently installed.

3. Compare def_time with your expected update frequency. If it is older than expected, continue to Step 2 to confirm whether a newer package is available.

Step 2: Compare against the latest packages published by OPSWAT

1. Download the MetaDescriptor file from http://update.dl.opswat.com/metadescriptor.

2. Find the entry for the engine using its engine_id. Example (values are for illustration only):

3. Identify the latest packages:

   • engine_package_version — the latest engine package.

   • database_package_version — the latest definition (database) package.

4. To find when a package was released on the OPSWAT update server, read the first Unix timestamp in its URL. In the example above, 1789740974 in database_url corresponds to 2026-09-18 14:16:14 UTC.

5. Compare the published values with the values installed on MetaDefender Core (from Step 1).

Interpret the results

If an update is pending for longer than your update frequency, check the update source and frequency settings, network or proxy access to the OPSWAT update server, and whether the engine is pinned to a specific version.

Recommendation

For monitoring and alerting, combine all three signals:

• Health Check outdated threshold (Health Check API, version 5.21.0 or later) as a coarse alarm for outdated engines.

• def_time from Engines Status (GET /stat/engines) to track the age of installed definitions.

• MetaDescriptor comparison to confirm the installed packages match the latest versions published by OPSWAT.