Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Drobo S Problem Sophos related?

Does anybody know if out-of-the-box Sophos Home Edition attaches itself to files on attached disk drives?

I have been having a problem.  I can't log on when my Drobo S is attached.  This has been going on for months and I have gone down many dead-ends.  The latest one is that running 'lsof +d /volumes/B1' on my MBP shows UserEvent is accessing the Applications folder on pretty much every attached partition.  When I manually break that connection I can log off and log on but the connection is recreated.

Today I discovered I could tell Sopos to exclude these partitions in its automatic startup configuration.  Upon rebooting and logging in, lsof produced no output.  I can only conclude that Sophos was responsible for this but I would like to confirm it.

I also found, at least so far, that I can log off and back on without disconnecting the Drobo S.  I will want to test this for several days but the UserEvent seems to be causing the problem and Sophos seems to be responsible for that.

Who knows anything about this?

:1010454


This thread was automatically locked due to age.
  • The On-access portion of Sophos will attach itself to any files being accessed on any local media.  It won't pass the file back to the system for reading/writing until it verifies there is no malicious content in the file.

    So, if your Drobo S is having a slow response time during startup and Sophos is scanning all the files, it is possible that the OS gives up attempting to access the resources after the timeout period allotted for logging in expires.

    This is all conjecture however; it sounds like you've done the appropriate investigation already.

    So the short answer is, Sophos isn't responsible for the open files, but it IS responsible for them being open slightly longer in a non-readable/writeable state than they normally would be.  Have you attempted to turn off Live Protection and see if that fixes the problem?  It's possible that Sophos is finding suspicious files on those remote filesystems and is calling home to look up the files prior to releasing the file lock. This would add an understandable delay during the already busy boot process.

    :1010480
  • > So, if your Drobo S is having a slow response time during startup and Sophos is scanning all the files, it is possible that the OS

    > gives up attempting to access the resources after the timeout period allotted for logging in expires.

    That could explain the problem.  It appears Sophos stays connected do all the partitions pretty much forever.  That may be because there is so much to check.

    Since blocking out all the partitions from Sophos investigation I am no longer having a problem logging in.  There are still some problems related, I think, to Mountain Lion, but I don't think they have anything to do with Sophos.

    :1010486
  • There was a Sophos update in early August.  Early August was also when my Drobo S began to act up.  My first thought was something was wrong with the Drobo but after all sorts of checks it came up clean.  Next I discovered that Sophos treats all attached drives as local, so I blocked the Drobo.  The problem was reduced but not eliminated.  Finally I totally removed Sophos from the computer and the problem went away.

    I believe the first release of Sophos I ran may have been 7.3.  At any rate, it has been a while and I never had any problems until August.

    I also have Sophos running on my wife's laptop but I use a different add-on drive on that and have had no problem.  I tried connecting the Drobo to my wife's computer and got the same problem as on mine so I removed Sophos from her computer as well.

    Here is the thing.  The latest release of Sophos appears to work okay with some attached drives but not all.  In particular, the Drobo S seems to have problems.  I say seems to because this problem has been kind of random, possibly related to the prvious message.  I will have to run this way for several days before I am sure the problem has really gone away.

    :1010492
  • One other thing which may be important.  I have 11 partitions on the Drobo S.  Only eight have caused problems, but of course, any one affects the whole system.  If Sophos can only handle eight attached partitions, that would be fairly convincing evidence that it was causing the problem.

    :1010494
  • The update in August introduced Live Protection, where suspicious files are looked up in realtime over the Internet.  This seems to fit with my previous supposition about what's going on.

    :1010504
  • I removed Sophos from my computer and my Drobo S is sort of back to normal.  I still have partitions that have to be forced to dismount, but I no longer have any problems logging on.   On balance, virus problems are less of an isue on Macs than mounting attached drives so I am going in that direction.

    Data Robotics does not actually support partitioning Drobo systems with DiskUtility and I found I can create disk images ith SuperDuper! so at some point I will do away with partitions and the mounting problem should go away.  I can then try re-installing Sophos to see what happens.

    :1010550