<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
<pre><font face="Helvetica, Arial, sans-serif">Hmm. I managed to fix this by changing the sophos-autoupdate in mailscanner to include sus??.vdb.
I'm still using the 4.xx SAVI files, which are a lot smaller (16 vs 96MB), since I only run mailscanner/SAVI on these machines.
My mods in green. The code's not real elegant, IMHO, but my perl's a little rusty, so I took the easy way out, and simply copied
the two lines above.
<font face="Courier New, Courier, monospace">
# Add the new vdl*.vdb files if they are there
foreach $number (1..99) {
$string = "vdl" . sprintf("%02d", $number) . ".vdb";
symlink("$VDLDir/$string", $string) if -f "$VDLDir/$string";
<b><font color="#33cc00"> $string = "sus" . sprintf("%02d", $number) . ".vdb";
symlink("$VDLDir/$string", $string) if -f "$VDLDir/$string";</font></b>
}</font>
>From the sav-install/README.TXT
</font>
</pre>
<blockquote><small><font face="Courier New, Courier, monospace"><small>*
Using and updating threat data<br>
<br>
Threat data consists of the files vdl.dat, vdl??.vdb, <font
color="#ff0000"><b>sus??.vdb</b></font>, and *.ide.<br>
<br>
The file vdl.dat is the main threat data file, which is updated monthly.<br>
This file is complemented by additional files vdl??.* (which contain
further<br>
threat data) and other additional files sus??.* (which contain data
about<br>
suspicious files). All these files are stored in the directory
specified by<br>
the option "SAV virus data directory" in the file /etc/sav.conf. By
default,<br>
the directory is /usr/local/sav.<br>
<br>
vdl.dat is actually a symlink to the file vdl.4.xx in the same
directory.<br>
<br>
For major threat alerts, the threat data has to be updated in between<br>
monthly releases of vdl.dat. In that case, IDE files are issued,
containing<br>
additional threat identities. These must be stored in the same
directory as<br>
vdl.dat.</small><br>
</font></small></blockquote>
<pre><font face="Helvetica, Arial, sans-serif">Cheerio,
- jeff
</font>
===
I failed to get to the bottom of this one and re-cloned the machine, as
it was faster to do :-)
Check your /etc/ld.so.conf and hose /opt/sophos-av,
/usr/local/lib/libsav*, /etc/sav* for starters, then reinstall the
latest version of version 6.
Make sure you haven't got any sav processes running.
service sav-protect stop
service sav-web stop
service sav-rms stop
chkconfig --del sav-web
chkconfig --del sav-protect
chkconfig --del sav-rms
Delete all /usr/local/Sophos* files. Do an "ldconfig" to flush the lib
cache. Delete /usr/local/bin/savscanm and /usr/bin/savscan.
Once you've deleted all the old one and reinstalled the new one, try
"savscan" on a file or two first to see if that works. If it does, then
rebuild perl-SAVI as well.
Good luck!
Howard Robinson wrote:
><i> Hello again
</i>><i> I am still having problems with the error below.
</i>><i> I have had a good look at the web and it seems that it would be better to uninstall Sophos then start again.
</i>><i> Is there a recommended way of doing this with out it having a knock on effect with MailScanner?
</i>><i>
</i>><i>
</i>><i>
</i>>>>><i> "Howard Robinson" <<a
href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">Howard at harper-adams.ac.uk</a>> 22/02/2008 16:59 >>>
</i>>>>><i>
</i>><i> Dear list
</i>><i> I have updated Sophos using Linux.intel.libc6.tar.Z using Julian's routine /usr/sbin/Sophos.install
</i>><i>
</i>><i> It appeared to run through okay but seemed fast!
</i>><i> Anyway on restarting MailScanner I get the following in the Maillog and emails refused to move in or out.
</i>><i>
</i>><i> "SophosSAVI ERROR:: getting version: One of the files in a split-virus data set could not be located (557)"
</i>><i>
</i>><i> Any ideas
</i>><i> I had a quick look at WIKI but nothing appeared to be relevant .
</i>><i>
</i>><i> In the end I had to rem out sophos from list of virus scanners used to get email flowing again. Two others are still there and so we are not unprotected but I like Sophos and usually it updates ok
</i>><i>
</i>><i> Any help appreciated.
</i>><i>
</i>><i> Thanks
</i>><i> Howard Robinson,
</i>><i> (Senior Technical Development Officer),
</i>><i> Harper Adams University College,
</i>><i> Edgmond,
</i>><i> Newport,
</i>><i> Shropshire ,
</i>><i> TF10 8NB.
</i>><i>
</i>><i> Tel. Direct 01952 815253
</i>><i> Tel. Switch Board 01952 820280
</i>><i> Fax 01952 814783
</i>><i> Email <a
href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">hrobinson at harper-adams.ac.uk</a>
</i>><i> Web <a class="moz-txt-link-abbreviated" href="http://www.harper-adams.ac.uk">www.harper-adams.ac.uk</a>
</i>><i>
</i>><i>
</i>><i> --
</i>><i> MailScanner mailing list
</i>><i> <a
href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"><font color="red"><b>MailScanner has detected a possible fraud attempt from "lists.mailscanner.info" claiming to be</b></font> mailscanner at lists.mailscanner.info</a>
</i>><i> <a
href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a>
</i>><i>
</i>><i> Before posting, read <a
href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a>
</i>><i>
</i>><i> Support MailScanner development - buy the book off the website!
</i>><i>
</i>><i>
</i>
Jules
- --
Julian Field MEng CITP CEng
<a class="moz-txt-link-abbreviated" href="http://www.MailScanner.info">www.MailScanner.info</a>
Buy the MailScanner book at <a class="moz-txt-link-abbreviated" href="http://www.MailScanner.info/store">www.MailScanner.info/store</a>
Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</pre>
</body>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
</html>