SophosSAVI Broke?

[Hirsh, Joshua]

Hey All,

 I came in this morning to find that my MailScanner processes were dying
off. Unfortunately, not much was being logged about the problem either.

 Here are the symptoms I've been able to track down:

 "Sep 17 09:05:05 PSLINMF01 postfix: Process did not exit cleanly, returned
0 with signal 11" was showing up in syslog, even though it was generated by
MailScanner (line 253 of /usr/sbin/MailScanner), it set the name as postfix.

 MailScanner also reports this in the logs, but nothing else:

 Sep 17 08:02:45 PSLINMF01 MailScanner[3957]: MailScanner E-Mail Virus
Scanner version 4.23-11 starting...
 Sep 17 08:02:55 PSLINMF01 MailScanner[3960]: MailScanner E-Mail Virus
Scanner version 4.23-11 starting...
 Sep 17 08:03:05 PSLINMF01 MailScanner[3963]: MailScanner E-Mail Virus
Scanner version 4.23-11 starting...


 Running MailScanner in debug mode worked fine, and it scanned and delivered
mail. So I ran an strace on MailScanner while it was running to try and
catch what was happening. The child processes showed they were dying with a
SIGSEGV just after trying to read /etc/sav.conf (before you ask, no it
doesn't exist).

 My logs show that this all started happening just after 6AM EST, so I
figured one of the Sophos updates might have been broken for some weird
reason. I re-installed Sophos, even tried to do so without the latest IDE
updates. Still no luck, MailScanner refused to start.

 I changed the scanner to sophos instead of sophossavi and everything
started working again.


 Anyone have any ideas or suggestions? I saved the strace output, but
nothing stuck out as blatantly obvious to me.



 Thanks,

-Joshua