Re: sophie processing not dying

I didn't post it to the list and probably should have, but my problem ended 
up being how I was HUPing sophie.  I was using daemontools to run sophie 
because I had problems with it dying in the past (before the current 
version).  I was doing a "svc -h /service/sophie" to reload virus 
definitions and this was not working because of the way the new sophie 
starts. The new one spawns off two processes which daemontools did not 
understand. Basically, everytime I "HUPed" sophie, I had a new one lying 
around.


Trey Nolen




> On Wed, 29 Jun 2005, Trey Nolen wrote:
>> The majority are being cleaned up correctly.  It has been roughly 4 hours 
>> since I sent that email and I killed all the sophie processes right after 
>> I sent them.  I just checked and I have 6 sophie processes running now. 
>> These processes are static.  We have been running sophos/sophie for years 
>> and this has just started happening since I made the update to the new 
>> sophie and the new sophos.  Unfortunately, I did do both updates (the new 
>> engine) at the same time, so I can't tell which one is causing the issue. 
>> We had been running 3.04rc2 without incident for a long time, but I had 
>> seen the issues with file corruption so we changed the sophie version 
>> before updating to 3.95.
>>
>> Trey Nolen
>
> I started having a similar problem last night.  It started when one of our 
> mail servers started rejecting connections.  I went to check the system 
> and it had 20-30 sophie processes spawned and the cpu load was extremely 
> high.  However, the sophie processes were not using any load nor were any 
> other processes using any significant load (I forgot to check system and 
> iowait so it must have been one of those causing the load).  I then 
> started shutting down all the services but I could not shutdown any of the 
> sophie processes ('kill -9' did not even work).  So I had to reboot the 
> system to get it functional again.  At this point this has happened 3 
> times in the past 24 hours on 2 different mail servers.  Also when the 
> first sophie process hangs all subsquent sophie processes hang in the same 
> fashion.
>
> Here is what I see in the logs on the failures:
> Jul 12 16:40:49 swlx166 sophie[697]: NOTICE           : Current PROC_COUNT 
> is '1' /DEBUG,697/
> Jul 12 16:40:49 swlx166 sophie[697]: NOTICE           : Cleared buf using 
> memset() /DEBUG,697/
> Jul 12 16:40:49 swlx166 sophie[697]: NOTICE           : read 37 bytes from 
> socket /DEBUG,697/
> Jul 12 16:40:49 swlx166 sophie[697]: NOTICE           : Read: 
> '/var/spool/exim/scan/1DsSUj-0000BE-DO' /DEBUG,697/
> Jul 12 16:40:49 swlx166 sophie[697]: NOTICE           : Scanning file 
> '/var/spool/exim/scan/1DsSUj-0000BE-DO/1DsSUj-0000BE-DO.eml' /
>
> I then see nothing else related to that process when I should see this at 
> some point:
> Jul 12 16:40:42 swlx166 sophie[685]: NOTICE           : Response is '0' 
> /DEBUG,685/
> Jul 12 16:40:42 swlx166 sophie[685]: NOTICE           : Response '0' sent 
> /DEBUG,685/
> Jul 12 16:40:42 swlx166 sophie[685]: NOTICE           : Alarm (300) set 
> /DEBUG,685/
> Jul 12 16:40:42 swlx166 sophie[685]: NOTICE           : Child finished 
> /DEBUG,685/
>
> I thought it might be a specific message that was being scanned that 
> casued the problem but I could find no correlation between any of the 
> messages that were received at that time.
>
> Kenneth
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools
>