Sophos updates

[Julian Field]

At 21:56 02/12/2003, you wrote:
>At 01:27 PM 12/2/2003, Jason Balicki wrote:
>> >Does the automatic Sophos updating process installed with MailScanner
>> >include engine updates or just new virus signatures?
>>
>>MailScanner only updates the ide files.  You can use a script
>>called MajorSophos to download the engine, then run the
>>Sophos.install script included with MS.  I run it all from
>>cron on a monthly basis.
>>
>> >The mail logs show new Sophos ide files every hour on most
>> >days.  Are virus
>> >signatures updated that often or is this an artifact of the
>> >update script?
>>
>>In my experience, Sophos updates frequently, but to answer the
>>question I think you're asking:  no, it's probably not Sophos
>>updating every hour.  The autoupdate script does check every
>>hour, and AFAIK, it reports a sucessful update wether you needed
>>the update or not -- that's what you're seeing in your logs.
>>
>>You can find MajorSophos here:
>>http://www.tippingmar.com/majorsophos/
>>
>>--J(K)
>
>
>I see a new file (373_ides.zip) in /usr/local/Sophos/ide each time I check,
>not just the log entry.  If the updates are really new files, that implies
>MailScanner is downloading new files every hour whether virus data is new
>or not.

It downloads the 373_ides.zip file every hour. It's a very small file. It
doesn't necessarily contain any new files it hasn't seen before. But unless
you remember the size of the file from a previous run of the script,
there's no way to tell whether it actually contains any new files or not.
So it always gets unpacked and installed, regardless.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC  7222 11F6 5947 1415 B654