SOPHIE/Sophos stops responding after processing numerous messages

Hi,

I'm experiencing an intermittent problem with an installation of SOPHIE
and Sophos libsavi. The SOPHIE daemon is called by MIMEDefang from
Sendmail on RedHat. The versions are as follows:

    Sophie:     3.04rc2
    Sophos:     2.20
    MIMEDefang: 2.43
    Sendmail:   8.13.0

The MIMEDefang installation also runs other virus scanners (ClamAV,
F-Prot, and Symantec AVSE) and uses SpamAssassin. There's a cron job to
update the Sophos virus patterns every hour (ideget script) and another
to update the scan engine once a week (savget script), if updates are
available. If updates are found, it'll install them and do a "killall -s
HUP sophie".

After processing numerous messages (well, actually files in the Work/
directory that MIMEDefang creates for each message), the daemon will
just stop processing scan requests although it's still running and the
socket is still present (I think). Nothing short of killing the sophie
daemon and restarting it will resolve it. I've seen various references
to similar issues in this list's archives, so I'm not seeking to go over
old ground - unless someone has a resolution that doesn't appear on the
list?

In the absence of a resolution, what I am interested in is whether
anyone has written a watchdog/live-test script similar to the
contrib/clamdwatch.pl script that comes with Clam AntiVirus? (For those
unaware, it's run periodically and feeds the EICAR test signature to
clamd and watches the output, then acts if there's no response within a
set time [15s default]).

As both run as daemons and use sockets, I don't imagine it'll be rocket
science to use this PERL script as a template, but as my PERL's very
rusty I was hoping someone had already done something like this. Anyone?
:)

Cheers,
Matt



This email transmission is confidential and intended solely for the person or organisation to whom it is addressed. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of INSL. If you have received this message in error, do not open any attachments but please notify the INSL HelpDesk on +44 (0)870 241 1703, and delete this message from your system. Please rely on your own virus checkers as no responsibility is taken by the sender for any damage rising out of any bug or virus infection.

_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools