Corrupted files when run as daemon

Hi folks,

My configuration is like this:

- sophie-3.04rc2-1
- default /etc/sophie.cfg
- default /etc/sophie.savi

- Sophos (sweep -V):

Product version           : 3.93.0
Engine version            : 2.29.3
Virus data version        : 3.93
User interface version    : 2.07.093
Platform                  : Linux/Intel
Released                  : 02 May 2005
Total viruses (with IDEs) : 103742

- RedHat Enterprise Linux 4 (kernel 2.6.11.7)

Sophie is complaining about corrupted files when run in daemon-mode (sophie
-d). I've tested several files but Sophie thinks that every file is
corrupted.

[root@storage sophie-3.04rc2]# sample_apps/sock/scan_file /var/run/sophie
/tmp/eicar.com
FILE ERROR [Error: File corrupted, Sophie could not proceed.] (-1 received)
[root@storage sophie-3.04rc2]# sample_apps/sock/scan_file /var/run/sophie
/tmp/rrdtmp/storage_sit1-daily.png

And in the maillog it says:

May  5 01:48:22 storage sophie[2981]: WARNING          : Error: File
corrupted, Sophie could not proceed.

When run in debug mode:

[2005-05-05 01:49:37] NOTICE           : accept() set, scan type [1]
/DEBUG,3005/
[2005-05-05 01:49:37] NOTICE           : Current PROC_COUNT is '0'
/DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Successful setgid() to '500'
/DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Successful setuid() to '500'
/DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Cleared buf using memset()
/DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : read 34 bytes from socket
/DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Read:
'/tmp/rrdtmp/storage_sit1-daily.png' /DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Callbacks set /DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Scanning file
'/tmp/rrdtmp/storage_sit1-daily.png' /DEBUG,3007/
[2005-05-05 01:49:37] WARNING          : Error: File corrupted, Sophie could
not proceed.
[2005-05-05 01:49:37] NOTICE           : Response is '-1:Error: File
corrupted, Sophie could not proceed.' /DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Response '-1:Error: File corrupted,
Sophie could not proceed.' sent /DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : Alarm (300) set /DEBUG,3007/
[2005-05-05 01:49:37] NOTICE           : fork()ed a child - everything seems
ok /DEBUG,3005/
[2005-05-05 01:49:37] NOTICE           : Child finished /DEBUG,3007/

I started to check if sophos sweep was broken somehow, the sweep binary
found the EICAR-AV-Test-virus. So Postfix seems okay.

[root@storage sophie-3.04rc2]# sweep -ss /tmp/eicar.com
>>> Virus 'EICAR-AV-Test' found in file /tmp/eicar.com

I was wondering if Sophie was able to scan the file when it was run in a
regular mode (not daemonized).

[root@storage sophie-3.04rc2]# /usr/bin/sophie -f /tmp/eicar.com
...................
[2005-05-05 01:52:54] NOTICE           : Scanning file '/tmp/eicar.com'
[2005-05-05 01:52:54] WARNING          : Scan result => '/tmp/eicar.com'
infected with virus 'EICAR-AV-Test'

I'm very confused now: sweep works, sophie works but not in daemonized mode?

Might be a bug? I looked at the default configuration files, but couldn't
find any wrong settings.

Steyn Huizinga