This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[9.006-5] SAVI engine scan failed

On Sunday out of the blue, the web protection started to block all web traffic on the Sophos 9.006-5 running on a Pentium 4, 1GB RAM. Users were seeing "failed to get SAVI instance: no saviglue context". Reboots of the firewall did not help.

When the firewall's AV scanning was turned off in Web Protection: Web Filtering: Antivirus/Malware, web traffic started to work again.

When the firewall's Scan settings was changed from Sophos to Avira, under Management: System Settings: Scan Settings, and when the AV scanning was turned back on, web traffic continued to work.

The http.log shows errors like (I have attached a log extract):

ERROR: Failed to load Sophos Anti-Virus threat data
SAVI engine scan failed: Unknown SAVI error
SAVI init failed: One of the files in a split-virus data set has the wrong checksum

Can anyone tell me what happened to the SAVI engine? Is this a bug or RAM exhaustion?

This thread was automatically locked due to age.

Parents

0 scorpionking over 11 years ago
Seems there ist something gone wrong during the Up2Date process.

If you're a business user please have your reseller open a support case wih sophos support.

As a home license user I would save the config and do a clean reinstall, then reimport the config.
----------
Sophos user, admin and reseller.
Private Setup:

XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)

UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
Cancel
Vote Up 0 Vote Down

Cancel
0 jcherian over 11 years ago in reply to scorpionking

Well on the bright side, changing the scan engine to Avira has made the box use less memory as you can see in the attached png file which is a good thing when the firewall only has 1GB of memory.

I will have to try the wipe and reload/restore method when I am onsite next.

From the up2date log for the previous day:

I can see that u2d-savi-9.2515-2516 was installed successfully on April 13 at 21:21 (as you can see in the attached up2date logextract). But by 23:00, the firewall could no longer connect to the Authentication server. This failure to connect to the authentication servers (all six) continued until 11:46am the day of the trouble and a minute before the http saviscanner errors.

The firewall installedup2date package file '/var/up2date//savi/u2d-savi-9.2516-2517.patch.tgz.gpg'

And right after that, the http log started showing those saviscanner.c errors.

Is there a way to revert or delete the bad savi up2date install (other than a wipe and restore)?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jcherian over 11 years ago in reply to scorpionking

Well on the bright side, changing the scan engine to Avira has made the box use less memory as you can see in the attached png file which is a good thing when the firewall only has 1GB of memory.

I will have to try the wipe and reload/restore method when I am onsite next.

From the up2date log for the previous day:

I can see that u2d-savi-9.2515-2516 was installed successfully on April 13 at 21:21 (as you can see in the attached up2date logextract). But by 23:00, the firewall could no longer connect to the Authentication server. This failure to connect to the authentication servers (all six) continued until 11:46am the day of the trouble and a minute before the http saviscanner errors.

The firewall installedup2date package file '/var/up2date//savi/u2d-savi-9.2516-2517.patch.tgz.gpg'

And right after that, the http log started showing those saviscanner.c errors.

Is there a way to revert or delete the bad savi up2date install (other than a wipe and restore)?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data