Sophos Linux don't accept the configuration " UpdatePeriodMinutes "

Hi Henrique,

Please allow me to check on this and update you.

OK

Thanks

I'm afraid the product isn't designed to allow the 5-10 minute update to be disabled, even if on-access is disabled.

Good to read this

www.sophos.com/.../savl_9_cgeng.pdf

Remembering that this update after the boot did not occur before the recent new release of Sophos.

Nobody ?

You haven't asked a question.

DouglasLeeder said:

You haven't asked a question.

 

Again ...

The question is ...

How deactivat update on boot ?

Thanks

You can't, as I said before, there's no mechanism to disable it.

DouglasLeeder said:

You can't, as I said before, there's no mechanism to disable it.

 

But why, before the update new release, it don't updated on boot ?

There must be some mean.

Yes, it's a new feature.

Maybe change from a simple script

Maybe change from a simple script

I'll not know.

I am not progammer of the product.

Maybe grand toubab knows

Hello every bady !!!

Please, the Sophos free AV update on boot continue ?

I don't have AV instaled now.

Thanks !!!

No bady ???

I has solved it !!!

In this forum topic:

https://www.bleepingcomputer.com/forums/t/578679/sophos-antivirus-for-linux/

- Disable automatic updates from Sophos:

sudo /opt/sophos-av/bin/savsetup

enter "1" and press "enter"
enter "3" and press "enter"

http://localhost

full stop

press "enter"
type "N" and press "enter"
type "q" and press "enter"
(Unlike during the installation process, where you could choose to update from Sophos, your own update server, or
no server, no server is not listed as an option. You can however choose localhost, which will result in no updates
being downloaded unless your computer is already an update server.)

 

Now I am testing . ..

----------------------------------------------------

EDIT

Warning !!!

This solution not permite return the before condition.

Automatic update not work more after this and you need reinstall the AV again.

by !

Your method disables all updating.

As I said before the product updates:

a) During boot - if on-access enabled, talpa enabled, and no TBP matching the current kernel.

b) 5-10 minutes after savd starts.

c) UpdatePeriodMinutes after the last scheduled update.

b & c are controlled by the EnableAutoUpdating option.

Machines need to update every ~ 4 hours to get new protection data, otherwise protection is compromised.

DouglasLeeder 

Hello !!!

I now configured in the root terminal:

#/opt/sophos-av/bin/savconfig set EnableAutoUpdating false

After I verified with:

#/opt/sophos-av/bin/savconfig query EnableAutoUpdating

And it returned: " false " !!!

Now I manual updated every day with:

#/opt/sophos-av/bin/savupdate

Thanks Douglas !!!

Happy new year for you and your team from here Brazil !!!

by !!!

Hello,

For me it is as Douglas described

root@debian:~# /opt/sophos-av/bin/savconfig query EnableAutoUpdating
TRUE
root@debian:~# /opt/sophos-av/bin/savconfig query UpdatePeriodMinutes
1440
root@debian:~# systemctl status sav-protect
● sav-protect.service - "Sophos Anti-Virus daemon"
Loaded: loaded (/lib/systemd/system/sav-protect.service; disabled; vendor preset: enabled)
Active: active (running) since Tue 2019-01-08 11:25:18 CET; 37min ago
Docs: man:sav-protect
Process: 16120 ExecStartPre=/opt/sophos-av/engine/.sav-protect.systemd.prestart.sh (code=exited, status=0/SUCCESS)
Process: 16141 ExecStartPost=/opt/sophos-av/engine/.sav-protect.systemd.poststart.sh (code=exited, status=0/SUCCESS)
Main PID: 16140 (savd)
Tasks: 29 (limit: 4297)
Memory: 520.1M
CGroup: /system.slice/sav-protect.service
├─16140 savd etc/savd.cfg
└─16633 savscand --incident=unix://tmp/incident --namedscan=unix://root@tmp/namedscansprocessor.1 --ondemandcontro

janv. 08 11:25:14 debian savd[16140]: savd.daemon: ONACCESS-ENABLED fanotify
janv. 08 11:25:18 debian systemd[1]: Started "Sophos Anti-Virus daemon".
janv. 08 11:32:56 debian savd[16140]: update.updated: UPDATING_FROM_VERSION 9.15.1 3.74.2 5.58
janv. 08 11:32:56 debian savd[16140]: update.updated: Updating Sophos Anti-Virus....
Updating SAVScan on-demand scanner
Updating Virus Engine and Data
Updating Manifest
Update completed.
janv. 08 11:32:56 debian savd[16140]: update.updated: UPDATED_TO_VERSION 9.15.1 3.74.2 5.58
janv. 08 11:32:56 debian savd[16140]: update.updated: SUCCESSFULLY_UPDATED_FROM sdds:SOPHOS
janv. 08 11:37:05 debian savd[16140]: savscand.control.log: EXTRA-SCANNER-STARTED
janv. 08 11:37:11 debian savd[16140]: savscand.control.log: EXTRA-SCANNER-STOPPED
janv. 08 11:52:57 debian savd[16140]: savscand.control.log: EXTRA-SCANNER-STARTED
janv. 08 11:53:03 debian savd[16140]: savscand.control.log: EXTRA-SCANNER-STOPPED
root@debian:~#

Only one update after Sophos started.

Everything goes fine