Re: Sophie v3.05 and sophos-ide-update.pl disagree on PID?
Alain Fauconnet <[email protected]> Thu, 23 Feb 2006 18:34:46 +0700
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Alan, (Alain talking to Alan :-) On Thu, Feb 23, 2006 at 11:23:19AM +0000, Alan Thew wrote: > I mailed the list last month... > > On Fri, 27 Jan 2006 09:38 , Alan Thew <[email protected]> said: > > >On Fri, 27 Jan 2006 14:21 , Alain Fauconnet <[email protected]> said: > > > >>Hello readers, > >> > >>I've eventually taken the step from Sophie v1.44 to v3.05 (*). > >>Everything is file except that sophos-ide-update.pl keeps saying: > >> > >>Which Sophie PID: 12360 or 12359? Using the later. > >>SIGHUP sent to Sophie[12359] > >> > <snip> > >> > >>>From http://www.vanja.com/listarc/vtools/2005-November/001822.html > >>I understand that the right one would be 12360. Unfortunately that's not > >>the one sophos-ide-update.pl chooses. > >> > >>Any input on this? > > > >All I can add is that we've seen this but only once (so far). It seems to > >get it right most times. We're running ours on Linux. > > It's happened twice on 5 days on one of our Red Hat boxes. Is anyone > else seeing this? I was seeing this coming up systematically until I eventually disabled the lsof search in sophos-ide-update.pl, commenting out the $lsof_path = ... line. As far as I can tell, the lsof method yields the wrong PID with the current Sophie, and it takes precedence over the PID file, so sophos-ide-update.pl HUPs the wrong process. The PID file method is good enough for me, and sophos-ide-update.pl has been working flawlessly since then. I've had no reply from Mark Martinec to my report. Greets, _Alain_