free linux AV noob Qs

1) Each build of the Linux kernel requires a custom compiled set of kernel modules for the on-access anti-virus to intercept file operations. Sophos ships pre-compiled kernel modules for kernels on some supported platforms, and otherwise attempts to compile locally if on a different kernel. You are on a system running a kernel that Sophos doesn't ship pre-compiled binary modules for, so it has compiled locally. This is very common and nothing to worry about, but means you need to keep the compile environment installed when you update your kernel.

2) savupdate is run automatically once an hour to update Sophos Anti-virus for Linux, so you don't need to run it yourself.

1) Each build of the Linux kernel requires a custom compiled set of kernel modules for the on-access anti-virus to intercept file operations. Sophos ships pre-compiled kernel modules for kernels on some supported platforms, and otherwise attempts to compile locally if on a different kernel. You are on a system running a kernel that Sophos doesn't ship pre-compiled binary modules for, so it has compiled locally. This is very common and nothing to worry about, but means you need to keep the compile environment installed when you update your kernel.

2) savupdate is run automatically once an hour to update Sophos Anti-virus for Linux, so you don't need to run it yourself.

[ubuntu 16.04, Sophos 9.14 free]

 

Hi,

does 1) mean, that I have to recompile the Sophos kernel modules after a kernel update? If so, how do I do this?

 

Kind regards

Ulrich

Hi Ulrich,

 

No Sophos Anti-Virus will compile Talpa automatically, when it starts up on a system with a new kernel. It just means that you need to keep a suitable compile environment installed on the machine.

 

Thanks,

Douglas.

ok, thank you for the quick answer!

I just wondered, because I get an error when using Sophos with Ilias LMS. Scan-command is set to 'savscav –all –nc –archive', clean-command is set to 'savscan –all –nc –remove –archive'.

When uploading an uninfected file to Ilias, I get something like:

"Unknown Error
xyz.jpg"

Using eicar-virus signature:

"In der hochzuladenden Datei wurde ein Virus gefunden!<br />Could not open –all<br /> Could not open –nc<br /> Could not open –remove<br /> Could not open –archive<br /> >>> Virus 'EICAR-AV-Test' found in file /tmp/phpv6ubrv [3]<br />Der Virus konnte nicht aus der Datei entfernt werden.
eicar.txt "

When I disable Sohops in Ilias setup, all works well - without virus protection, of course. It already had worked, and there have been kernel updates since. So I thought, it might be due to kernel updates ...

Regards
Ulrich

No, I suspect you are using the wrong '-' - '–' not '-'

Try it on the command-line, and make sure you are actually passing command line options, not files called –nc

Got it!

Sorry, I did not recognize those mdashes! Using the correct "-" solves the problem.

Many thanks!

Uli