Re: sophie under Solaris doesn't work with Sophos ver. 3.92

Andrzej Marecki <[email protected]> Wed, 30 Mar 2005 10:50:46 +0200
Newsgroups gmane.comp.security.virus.vtools
Organization Torun Radio Astronomy Observatory, Poland
Message-ID <[email protected]>
Alain Fauconnet wrote:

> Which version of Solaris, on what hardware?

2.6 on Sparc Ultra-2.

> Have you tried running Sophie with debug on, in foreground
> (non-daemon) mode? ("sophie -d")

Yes.

> Any error message?

Here's a piece of the log pertinent to the critical event. Let me reiterate
that the final result of the abnormal operation of sophie with the latest
version of libsavi.so (3.92) for Solaris is that the socket file disappears
and so any further analyses are not possible.

NOTICE           : accept() set, scan type [1] /DEBUG,3470/
NOTICE           : fork()ed a child - everything seems ok /DEBUG,3470/
NOTICE           : Current PROC_COUNT is '0' /DEBUG,3541/
NOTICE           : Successful setgid() to '70' /DEBUG,3541/
NOTICE           : Successful setuid() to '70' /DEBUG,3541/
NOTICE           : Cleared buf using memset() /DEBUG,3541/
NOTICE           : read 49 bytes from socket /DEBUG,3541/
NOTICE           : Read: '/var/spool/MIMEDefang/mdefang-j2TDKNlc017877/Work' /DEBUG,3541/
NOTICE           : Scanning file '/var/spool/MIMEDefang/mdefang-j2TDKNlc017877/Work/msg-3505-2.virus' /DEBUG,3541/
NOTICE           : SIGNAL '11' caught - cleaning up and exiting.
NOTICE           : pSAVI cleaned up and released/terminated

If things go right (with e.g. ver. 3.91 of libsavi.so), the two last lines
do not appear, of course. Instead, four lines like these are generated:

NOTICE           : Response is '0' /DEBUG,.../
NOTICE           : Response '0' sent /DEBUG,.../
NOTICE           : Alarm (300) set /DEBUG,.../
NOTICE           : Child finished /DEBUG,.../

HTH.

Cheers, Andrzej

-- 
-----------------------------------------------------------------------------  
Andrzej Marecki                | 
Torun Centre for Astronomy     |   e-mail: [email protected]
N. Copernicus University       |   WWW:    http://www.astro.uni.torun.pl
ul. Gagarina 11                |   tel: +48 56 6113032
PL-87-100 Torun, POLAND        |   fax: +48 56 6113009
-----------------------------------------------------------------------------  
"If Bill Gates actually had to admin his own stuff, he'd shoot himself."
-----------------------------------------------------------------------------