Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 6 subscribers
  • Views 2587 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Drobo S Problem Sophos related?

rbpeirce

Does anybody know if out-of-the-box Sophos Home Edition attaches itself to files on attached disk drives?

I have been having a problem.  I can't log on when my Drobo S is attached.  This has been going on for months and I have gone down many dead-ends.  The latest one is that running 'lsof +d /volumes/B1' on my MBP shows UserEvent is accessing the Applications folder on pretty much every attached partition.  When I manually break that connection I can log off and log on but the connection is recreated.

Today I discovered I could tell Sopos to exclude these partitions in its automatic startup configuration.  Upon rebooting and logging in, lsof produced no output.  I can only conclude that Sophos was responsible for this but I would like to confirm it.

I also found, at least so far, that I can log off and back on without disconnecting the Drobo S.  I will want to test this for several days but the UserEvent seems to be causing the problem and Sophos seems to be responsible for that.

Who knows anything about this?

:1010454


This thread was automatically locked due to age.
Parents
  • 0

    The On-access portion of Sophos will attach itself to any files being accessed on any local media.  It won't pass the file back to the system for reading/writing until it verifies there is no malicious content in the file.

    So, if your Drobo S is having a slow response time during startup and Sophos is scanning all the files, it is possible that the OS gives up attempting to access the resources after the timeout period allotted for logging in expires.

    This is all conjecture however; it sounds like you've done the appropriate investigation already.

    So the short answer is, Sophos isn't responsible for the open files, but it IS responsible for them being open slightly longer in a non-readable/writeable state than they normally would be.  Have you attempted to turn off Live Protection and see if that fixes the problem?  It's possible that Sophos is finding suspicious files on those remote filesystems and is calling home to look up the files prior to releasing the file lock. This would add an understandable delay during the already busy boot process.

    :1010480
Reply
  • 0

    The On-access portion of Sophos will attach itself to any files being accessed on any local media.  It won't pass the file back to the system for reading/writing until it verifies there is no malicious content in the file.

    So, if your Drobo S is having a slow response time during startup and Sophos is scanning all the files, it is possible that the OS gives up attempting to access the resources after the timeout period allotted for logging in expires.

    This is all conjecture however; it sounds like you've done the appropriate investigation already.

    So the short answer is, Sophos isn't responsible for the open files, but it IS responsible for them being open slightly longer in a non-readable/writeable state than they normally would be.  Have you attempted to turn off Live Protection and see if that fixes the problem?  It's possible that Sophos is finding suspicious files on those remote filesystems and is calling home to look up the files prior to releasing the file lock. This would add an understandable delay during the already busy boot process.

    :1010480
Children
No Data