Hi, I'm Simon Fu from Sophos Support and today I will be covering
On-Access Scanning with Sophos Antivirus for Linux
In this video, we'll be covering how to check if On-Access file scanning is enabled after successfully installing Sophos.
Afterwards, we'll go over how to check logs to see if Talpa is returning any errors
and lastly, if Talpa isn't compatible with your kernel version,
we'll cover how to use Fanotify as a kernel interface.
With that said let's look at On-Access scanning.
Sophos Antivirus for Linux provides several methods of enabling On-Access file scanning using either Fanotify or Talpa.
To check if On-Access is active after successful installation, first type
su space minus to log in as root.
Once logged in, go to the directory slash opt slash sophos dash av slash bin
Do a ls space minus l
This will list the available Sophos Antivirus for Linux commands.
Execute the command. Save the status by typing
dot slash sav d s t a t u s then press enter
From the output, you can see Sophos Antivirus is active but On-Access scanning is not running.
If you log in to Sophos Central you will see alerts stating real time protection
is disabled and policy non-compliance malware protection.
You shall also receive a high email alert stating real-time protection has been disabled on a computer
and a medium alert stating the computer does not comply with Sophos Central policy.
To find out why On-Access is not running execute the below command
dot slash s a v l o g space -10
This will display the last 10 entries of the Sophos Antivirus log.
As you can see it's unable to load Talpa modules hence On-Access scanning failed to start.
Please note, Sophos no longer supports the use of Talpa module for On-Access
scanning on Linux systems that contain docker containers.
You will need to switch to Fanotify.
For more details of the support coverage of Sophos Antivirus for Linux environments
where Docker containers are used, please refer to Sophos KB article.
Sophos provides pre-compiled Talpa binary packs for certain kernel versions.
To check why Talpa failed to load, you will need to check the kernel version running on the system.
To do so, you can execute the following command
u name minus a
Once you have obtained the information from the above command,
check if the kernel version is listed in the pre-compiled Talpa binary packs which is available in Sophos KB article
and if it is not listed, you will need to either compile Talpa locally or switch to Fanotify.
In this video I will show you how to set Fanotify as the default kernel interface.
Please note Linux operating system is case-sensitive.
In the current working directory that is slash opt slash sophos dash av slash bin
execute the following commands
dot slash sav config space set space PreferFanotify space true
then dot slash sav config space set space disableFanotify space false
Once the above is set restart the Sophos Antivirus daemon by running
slash etc slash init dot d slash sav dash protect space restart
After the service is restarted you can then check and confirm if On-Acess is
running by executing the self d status command again that is
dot slash savdstatus
as you can see Sophos Antivirus is now active and On-Access scanning is running.
You can further validate if On-Access is using Fanotify by the sav log command
dot slash savlog space -10
From the output, you can see On-Access scanning is enabled using Fanotify.
In Sophos Central dashboard you shall see the Linux endpoint will have two new events logged.
One stating real-time protection is re-enabled
and the other stating policy in compliance malware
Fanotify is now set to be the default kernel interface for On-Access scanning.
This setting will be in place in the next reboot.
I hope you found this video useful.
Let us know by giving us a thumbs up on Techvids and let us know if we resolved your issue.
Check out the documentation for this video in the video description.
For further assistance view and post questions on community.sophos.com
and go to techvids.sophos.com for more great videos like this one.
Thanks for watching