Re: Sophie Hanging

David Birnbaum <[email protected]> Thu, 18 Mar 2004 11:30:56 -0500 (EST)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Thu, 18 Mar 2004, Vanja Hrustic wrote:

> > I do need to report a bug.  Every once in about 10-15K scans, sophie
> > will hang.  A truss of the process shows sitting in a poll().  Attempts
> > by the client to open the socket going forward fail.  Can't figure out a
> > pattern, and can't figure out how to grab any more useful diagnostics.
> >
> > Any suggestions on what might be the cause?  I'm happy to provide a core
> > dump or other useful analytics if that would be helpful.
>
> I presume it's happening on Solaris? :(

Yup.  2.8.

> Did it happen always, or it started happening after certain version of
> SAVI? If I am not mistaken, Sophos did change compiler (or something
> else?) at certain point of time, for Solaris releases.

It never happened with sophie 1.X, if I recall.  It's been happening with
sophie 3.X consistently through SAVI upgrades.

> There has been some input, before, in relation to some thread (un)safe
> functions, and those have been already fixed (and seems like fixes worked,
> at least for some cases).
>
> I, honestly, have no idea where else to look, without something more
> specific :(

What would be helpful?  Core dump?  Thread status?  The truss is kinda
useless.  Let me know, I'll be happy to collect it when I can.  I agree,
it seems like there's a thread problem given that the process is clearly
"alive".  Perhaps a kill -HUP might reset it without killing it?

Thanks,

David.