RE: Sophie Hanging

"CertaintyTech-Ed" <[email protected]> Thu, 18 Mar 2004 12:44:02 -0500
Newsgroups gmane.comp.security.virus.vtools
Message-ID <00d101c40d10$9a28a7d0$9300a8c0@ED01>
I also see this happen on occasion and is accompanied with a missing
sophie socket file.  What I have done is setup a cron that checks for
the existence of the sophie socket file.  If it doesn't exist the
restart sophie.  This doesn't fix the root of the problem but does keep
the email flowing.  BTW, I run Solaris 8 x86

---
Ed Henderson, Managing Partner
Certainty Tech
http://www.certainty.net/


> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of David Birnbaum
> Sent: Thursday, March 18, 2004 11:31 AM
> To: Vanja Hrustic
> Cc: Discussion about Virge/Sophie/Trophie/...
> Subject: Re: [vtools] Sophie Hanging
> 
> 
> On Thu, 18 Mar 2004, Vanja Hrustic wrote:
> 
> > > I do need to report a bug.  Every once in about 10-15K 
> scans, sophie
> > > will hang.  A truss of the process shows sitting in a 
> poll().  Attempts
> > > by the client to open the socket going forward fail.  
> Can't figure out a
> > > pattern, and can't figure out how to grab any more useful 
> diagnostics.
> > >
> > > Any suggestions on what might be the cause?  I'm happy to 
> provide a core
> > > dump or other useful analytics if that would be helpful.
> >
> > I presume it's happening on Solaris? :(
> 
> Yup.  2.8.
> 
> > Did it happen always, or it started happening after certain 
> version of
> > SAVI? If I am not mistaken, Sophos did change compiler (or something
> > else?) at certain point of time, for Solaris releases.
> 
> It never happened with sophie 1.X, if I recall.  It's been 
> happening with
> sophie 3.X consistently through SAVI upgrades.
> 
> > There has been some input, before, in relation to some 
> thread (un)safe
> > functions, and those have been already fixed (and seems 
> like fixes worked,
> > at least for some cases).
> >
> > I, honestly, have no idea where else to look, without something more
> > specific :(
> 
> What would be helpful?  Core dump?  Thread status?  The truss is kinda
> useless.  Let me know, I'll be happy to collect it when I 
> can.  I agree,
> it seems like there's a thread problem given that the process 
> is clearly
> "alive".  Perhaps a kill -HUP might reset it without killing it?
> 
> Thanks,
> 
> David.
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>