Re: sophie processing not dying

Martin Zuziak <[email protected]> Wed, 29 Jun 2005 22:50:23 +0200
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Wed, Jun 29, 2005 at 09:12:47AM -0500, Trey Nolen wrote:
> Since upgrading to the new Sophie ( 3.04) from 3.04rc? and upgrading from 
> sweep 3.92 to 3.95, I'm not having trouble with corrupted files but I AM 
> having trouble with lots of sophie processes hangning around.  Before the 
> change, I'd have 1 or 2 processes.  Usually I would have to restart sophie 
> about every 3 days because it would quit responding.  When that happened, 
> it would genereally have 2 processes running.   Now, it is scanning OK, but 
> there are more and more sophies. Right now, I have 35 of them.  Yesterday 
> afternoon, my server ran out of memory and I had to kill off all the 
> sophies.

If a sophie child is just hanging around, a possibility is that it's
waiting for input on the socket.

Try attaching strace on one of the children and see if it isn't in a
read(). If it's waiting to read on the socket then see what's on the
other end.

Example: if your application (qmailscanner?) were to write a filepath to
the socket without a newline at the end then sophie will wait for a line
terminator.

The problem with this hypothesis is that it doesn't explain your other
problem, that sophie stops responding after a few days with only a few
running instances. Nor will it explain why you only started seeing this
problem recently. Unless you have made changes to the application
talking to sophie.

Martin Zuziak <[email protected]>