sophossavi not work after the sophos update the engine libsavi.so.3.2.07.391

[Eric Yiu]

Hi,

I having been using mailscanner with several machines for years with
sophossavi. After the monthly auto update from Sophos and installed
libsavi.so.3.2.07.391, I found that the sophos engine does not exit
even after the email can be scanned out virus, it just hold and
finally return:

Virus Scanning: Denial Of Service attack detected!
Commercial scanner sophossavi timed out!

at the log. I originally thought that it is just because my outdated
mailscanner. I figured out where is the problem and added a code to kill
itself after scanning. Now I have another machine and installed the
current version mailscanner but still the same. Here is my ugly fix:

# diff /opt/MailScanner/lib/MailScanner/SweepViruses.pm.old
/opt/MailScanner/lib/MailScanner/SweepViruses.pm
1132a1133

kill 9, $$;

My new mailscanner version is 4.84.6

Any other good solution for that?

Regards,

Eric Yiu

[Stef Morrell]

Hello,

Post by Eric Yiu
I having been using mailscanner with several machines for years with
sophossavi. After the monthly auto update from Sophos and installed
libsavi.so.3.2.07.391, I found that the sophos engine does not exit
even after the email can be scanned out virus, it just hold and
Virus Scanning: Denial Of Service attack detected!
Commercial scanner sophossavi timed out!

I think I may well be seeing the same problem (my libsavi version matches at least).

At around 4am, my system ran a Sophos Engine update, as it does on the 7th of every month called by cron. I'm using the MajorSophos script to log into Sophos and download the latest engine, which then calls the Sophos installation script included with MS.

Along with the normally scheduled definition updates downloaded by Sophos-autoupdate, this left me with the following:

Current Sophos version information follows:
Product version : 4.96.1 Engine version : 3.50.1 Virus data version : 4.97 Released : 15 January 2014

Prior to this, all was running perfectly well. I am configured to use clam and sophossavi (SAVI 0.30) as my scanners.

Post by Eric Yiu
From my logs it's clear that at this point MailScanner (4.84.5-3) gave up and died.

I've tried running test batches, but there's no error. I get the message about meaningless output to keep SAVI happy, but that's all. Meantime in my mail.log I can see Clam performed its scans successfully, but then it just appears to hang. No other information appears in any logs that I can find.

I have tried manually running sweep from the MS sophos-wrapper script - this works fine.
I have tried running example perl script included with SAVI - this works fine.
I have tried switching from sophossavi to sophos - same problem.
I have tried removing Sophos altogether and running just with ClamAV - MS performs as expected.

I didn't see Eric's email until recently, having been processing a massive email queue, using just Clam, so I've not left it alone long enough to potentially see his timeout message. (In hindsight I should probably have checked online list archives, but anyway).

Hitting Sophos with a SIGKILL per Eric's suggestion seems a bit extreme. Has anyone else seen this problem and have an alternate solution, or can point me at where to look for some more useful diagnostics, as I presently have next to nothing to go on.

Thanks

Stef