Re: Sophie v3.05 and sophos-ide-update.pl disagree on PID?

Alan Thew <[email protected]> Thu, 23 Feb 2006 13:30:59 +0000 (GMT)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Thu, 23 Feb 2006 18:34 , Alain Fauconnet <[email protected]> said:

> Alan, (Alain talking to Alan :-)
>
> On Thu, Feb 23, 2006 at 11:23:19AM +0000, Alan Thew wrote:
>> I mailed the list last month...
>>
>> On Fri, 27 Jan 2006 09:38 , Alan Thew <[email protected]> said:
>>
>>> On Fri, 27 Jan 2006 14:21 , Alain Fauconnet <[email protected]> said:
>>>
>>>> Hello readers,
>>>>
>>>> I've eventually taken the step from Sophie v1.44 to v3.05 (*).
>>>> Everything is file except that sophos-ide-update.pl keeps saying:
>>>>
>>>> Which Sophie PID: 12360 or 12359? Using the later.
>>>> SIGHUP sent to Sophie[12359]
>>>>
>> <snip>
>>>>
>>>>> From http://www.vanja.com/listarc/vtools/2005-November/001822.html
>>>> I understand that the right one would be 12360. Unfortunately that's not
>>>> the one sophos-ide-update.pl chooses.
>>>>
>>>> Any input on this?
>>>
>>> All I can add is that we've seen this but only once (so far). It seems to
>>> get it right most times. We're running ours on Linux.
>>
>> It's happened twice on 5 days on one of our Red Hat boxes. Is anyone
>> else seeing this?
>
> I was seeing this coming up systematically until I eventually disabled
> the lsof search in sophos-ide-update.pl, commenting out the $lsof_path
> = ... line. As far as I can tell, the lsof method yields the wrong PID
> with the current Sophie, and it takes precedence over the PID file, so
> sophos-ide-update.pl HUPs the wrong process.
>
> The PID file method is good enough for me, and sophos-ide-update.pl has
> been working flawlessly since then.
>
Thanks very much.

-- 
Alan Thew                                       [email protected]
Computing Services, University of Liverpool     Fax: +44 151 794-4442