Fwd: Sophos Error message

[Martin Sapsed]

Julian Field wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I failed to get to the bottom of this one and re-cloned the machine, as 
> it was faster to do :-)
> Check your /etc/ld.so.conf and hose /opt/sophos-av, 
> /usr/local/lib/libsav*, /etc/sav* for starters, then reinstall the 
> latest version of version 6.
> Make sure you haven't got any sav processes running.
> service sav-protect stop
> service sav-web stop
> service sav-rms stop
> chkconfig --del sav-web
> chkconfig --del sav-protect
> chkconfig --del sav-rms
> Delete all /usr/local/Sophos* files. Do an "ldconfig" to flush the lib 
> cache. Delete /usr/local/bin/savscanm and /usr/bin/savscan.
> 
> Once you've deleted all the old one and reinstalled the new one, try 
> "savscan" on a file or two first to see if that works. If it does, then 
> rebuild perl-SAVI as well.

See down the bottom

> 
> Howard Robinson wrote:
>> Hello again
>> I am still having problems with the error below.
>> I have had a good look at the web and it seems that it would be better to uninstall Sophos then start again.
>> Is there a recommended way of doing this with out it having a knock on effect with MailScanner?
>>
>>
>>   
>>>>> "Howard Robinson" <Howard at harper-adams.ac.uk> 22/02/2008 16:59 >>>
>>>>>         
>> Dear list
>> I have updated Sophos using Linux.intel.libc6.tar.Z using Julian's routine /usr/sbin/Sophos.install
>>
>> It appeared to run through okay but seemed fast!
>> Anyway on restarting MailScanner I get the following in the Maillog and emails refused to move in or out.
>>
>> "SophosSAVI ERROR:: getting version: One of the files in a split-virus data set could not be located (557)"
>>
>> Any ideas
>>  I had a quick look at WIKI but nothing appeared  to be relevant .
>>
>> In the end I had to rem out sophos from list of virus scanners used to get email flowing again. Two others are still there and so we are not unprotected but I like Sophos and usually it updates ok 
>>
>> Any help appreciated.

We've got the same problem using solaris.sparc.tar.Z (V4.27) and rolled 
back to 4.26 to make it go away. I'm guessing from Howard's tar file 
that he's also using a pre-V6 version.

I suspect that something subtle has changed between 4.26 and 4.27 on 
Unix, which is tripping up SAVI?

Anyone else still using V4 on *ix?

Regards,

Martin

-- 
Martin Sapsed
Microcomputer Support Manager
IT Services                          "Who do you say that I am?"
Bangor University                          Jesus of Nazareth


-- 
Gall y neges e-bost hon, ac unrhyw atodiadau a anfonwyd gyda hi,
gynnwys deunydd cyfrinachol ac wedi eu bwriadu i'w defnyddio'n unig
gan y sawl y cawsant eu cyfeirio ato (atynt). Os ydych wedi derbyn y
neges e-bost hon trwy gamgymeriad, rhowch wybod i'r anfonwr ar
unwaith a dilëwch y neges. Os na fwriadwyd anfon y neges atoch chi,
rhaid i chi beidio â defnyddio, cadw neu ddatgelu unrhyw wybodaeth a
gynhwysir ynddi. Mae unrhyw farn neu safbwynt yn eiddo i'r sawl a'i
hanfonodd yn unig  ac nid yw o anghenraid yn cynrychioli barn
Prifysgol Bangor. Nid yw Prifysgol Bangor yn gwarantu
bod y neges e-bost hon neu unrhyw atodiadau yn rhydd rhag firysau neu
100% yn ddiogel. Oni bai fod hyn wedi ei ddatgan yn uniongyrchol yn
nhestun yr e-bost, nid bwriad y neges e-bost hon yw ffurfio contract
rhwymol - mae rhestr o lofnodwyr awdurdodedig ar gael o Swyddfa
Cyllid Prifysgol Bangor.  www.bangor.ac.uk

This email and any attachments may contain confidential material and
is solely for the use of the intended recipient(s).  If you have
received this email in error, please notify the sender immediately
and delete this email.  If you are not the intended recipient(s), you
must not use, retain or disclose any information contained in this
email.  Any views or opinions are solely those of the sender and do
not necessarily represent those of the Bangor University.
Bangor University does not guarantee that this email or
any attachments are free from viruses or 100% secure.  Unless
expressly stated in the body of the text of the email, this email is
not intended to form a binding contract - a list of authorised
signatories is available from the Bangor University Finance
Office.  www.bangor.ac.uk