Sophos SAVI problems

[Julian Field]

At 02:01 26/04/2003, you wrote:
>The problem I'm having is that when I change Virus Scanners = sophos to
>sophossavi and restart MailScanner something funky happens and mail
>stops going through.  The only part of the SAVI installation I had
>trouble with is the edit the Makefile.PL part.  There's no
>/opt/local/lib directory on my computer.  My solution was to replace
>both /opt/local/lib references with /usr/local/Sophos/lib instead of
>just the first one.  Probably not the right thing to do...  I then maked
>and tested and installed without error.

It looks as if your build of the Perl module worked fine. It doesn't matter
about setting both /opt/local/lib references as only 1 is ever used by
MailScanner, the other is irrelevant for us.

>   Below are (what I think are)
>the relevant sections of my maillog showing the funkiness.  Thanks for
>your help.

It watches the modification dates of the Sophos ide directory and the
Sophos lib directory. I have just added some more error-checking to the
code that does all this, so it should log slightly better what is going on.

Try applying this patch to /usr/lib/MailScanner/MailScanner/SweepViruses.pm:

---- PATCH STARTS ----
--- SweepViruses.pm.orig        2003-04-26 11:00:01.000000000 +0100
+++ SweepViruses.pm     2003-04-26 11:00:49.000000000 +0100
@@ -291,6 +291,9 @@

    my $SAVIidedir = MailScanner::Config::Value('sophoside');
    $SAVIidedir = '/usr/local/Sophos/ide' unless $SAVIidedir;
+  my $SAVIlibdir = MailScanner::Config::Value('sophoslib');
+  $SAVIlibdir = '/usr/local/Sophos/lib' unless $SAVIlibdir;
+
    $ENV{'SAV_IDE'} = $SAVIidedir;
    $SAVI = new SAVI();
    MailScanner::Log::DieLog("SophosSAVI ERROR:: initializing savi: %s (%s)",
@@ -342,10 +345,14 @@
    # Store the last modified time of the SAVI lib directory, so we can check
    # for major upgrades
    my(@statresults);
-  @statresults = stat(MailScanner::Config::Value('sophoside'));
-  $SAVIidedirmtime = $statresults[9];
-  @statresults = stat(MailScanner::Config::Value('sophoslib'));
-  $SAVIlibdirmtime = $statresults[9];
+  @statresults = stat($SAVIidedir);
+  $SAVIidedirmtime = $statresults[9] or
+    MailScanner::Log::WarnLog("Failed to read mtime of IDE dir
%s",$SAVIidedir);
+  @statresults = stat($SAVIlibdir);
+  $SAVIlibdirmtime = $statresults[9] or
+    MailScanner::Log::WarnLog("Failed to read mtime of lib dir
%s",$SAVIlibdir);
+  MailScanner::Log::InfoLog("Watching modification date of %s and %s",
+                            $SAVIidedir, $SAVIlibdir);
  }

  # Are there new Sophos IDE files?
---- PATCH ENDS ----

Let us know what it says.


>Daniel
>
>Apr 25 17:52:03 nts-2 MailScanner[4739]: MailScanner E-Mail Virus
>Scanner version 4.14-9 starting...
>Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI 3.68 (engine 2.14)
>recognizing 80979 viruses
>Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI using 15 IDE files
>Apr 25 17:52:05 nts-2 MailScanner[4739]: Using locktype = flock
>Apr 25 17:52:05 nts-2 MailScanner[4739]: New Batch: Scanning 2 messages,
>13643 bytes
>Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos update detected,
>resetting SAVI library
>Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos SAVI library has been
>updated, killing this child
>Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of old age
>Apr 25 17:52:13 nts-2 MailScanner[4741]: MailScanner E-Mail Virus
>Scanner version 4.14-9 starting...
>Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI 3.68 (engine 2.14)
>recognizing 80979 viruses
>Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI using 15 IDE files
>Apr 25 17:52:15 nts-2 MailScanner[4741]: Using locktype = flock
>Apr 25 17:52:15 nts-2 MailScanner[4741]: New Batch: Scanning 2 messages,
>13643 bytes
>Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos update detected,
>resetting SAVI library
>Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos SAVI library has been
>updated, killing this child
>Apr 25 17:52:15 nts-2 MailScanner[4741]: MailScanner child dying of old age
>Apr 25 17:52:23 nts-2 MailScanner[4744]: MailScanner E-Mail Virus
>Scanner version 4.14-9 starting...
>Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI 3.68 (engine 2.14)
>recognizing 80979 viruses
>Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI using 15 IDE files
>Apr 25 17:52:25 nts-2 MailScanner[4744]: Using locktype = flock
>Apr 25 17:52:25 nts-2 MailScanner[4744]: New Batch: Scanning 2 messages,
>13643 bytes
>Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos update detected,
>resetting SAVI library
>Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos SAVI library has been
>updated, killing this child
>Apr 25 17:52:25 nts-2 MailScanner[4744]: MailScanner child dying of old age
>Apr 25 17:52:33 nts-2 MailScanner[4750]: MailScanner E-Mail Virus
>Scanner version 4.14-9 starting...
>Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI 3.68 (engine 2.14)
>recognizing 80979 viruses
>Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI using 15 IDE files
>Apr 25 17:52:35 nts-2 MailScanner[4750]: Using locktype = flock
>Apr 25 17:52:35 nts-2 MailScanner[4750]: New Batch: Scanning 2 messages,
>13643 bytes
>Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos update detected,
>resetting SAVI library
>Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos SAVI library has been
>updated, killing this child
>Apr 25 17:52:35 nts-2 MailScanner[4750]: MailScanner child dying of old age
>Apr 25 17:52:43 nts-2 MailScanner[4751]: MailScanner E-Mail Virus
>Scanner version 4.14-9 starting...
>Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI 3.68 (engine 2.14)
>recognizing 80979 viruses
>Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI using 15 IDE files
>Apr 25 17:52:45 nts-2 MailScanner[4751]: Using locktype = flock
>Apr 25 17:52:45 nts-2 MailScanner[4751]: New Batch: Scanning 2 messages,
>13643 bytes
>Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos update detected,
>resetting SAVI library
>Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos SAVI library has been
>updated, killing this child
>Apr 25 17:52:45 nts-2 MailScanner[4751]: MailScanner child dying of old age

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support