Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 7 subscribers
  • Views 20429 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Causing Mac OS Abort/Restarts

stephengerrard

Sophos has caused 4 restarts in the past 2 days ... There have been posts about this problem in the past, with the answer being that the problem has been resolved in the latest version, but I am on the latest version (9.2.4) and it is still happening. Copy of Mac abort report:

*** Panic Report ***

panic(cpu 2 caller 0xffffff80239453eb): "vnode_rele_ext: vp 0xffffff8046b205a0 usecount -ve : -1. v_tag = 16, v_type = 1, v_flag = 84800."@/SourceCache/xnu/xnu-2782.1.97/bsd/vfs/vfs_subr.c:1867

Backtrace (CPU 2), Frame : Return Address

0xffffff812dde33d0 : 0xffffff802373a811

0xffffff812dde3450 : 0xffffff80239453eb

0xffffff812dde3490 : 0xffffff7fa3e1958f

0xffffff812dde34b0 : 0xffffff7fa3e18de2

0xffffff812dde3800 : 0xffffff7fa3e1ae94

0xffffff812dde3840 : 0xffffff8023ba2c66

0xffffff812dde38a0 : 0xffffff802394834a

0xffffff812dde38f0 : 0xffffff8023966ebe

0xffffff812dde3990 : 0xffffff8023952688

0xffffff812dde3bd0 : 0xffffff8023953260

0xffffff812dde3f50 : 0xffffff8023c4dcb2

0xffffff812dde3fb0 : 0xffffff802383ac46

     Kernel Extensions in backtrace:

         com.sophos.kext.sav(9.2.50)[D9AF65D9-4A18-3B20-86BB-17DEBC7D5852]@0xffffff7fa3e18000->0xffffff7fa3e1cfff

BSD process name corresponding to current thread: mds_stores

Mac OS version:

14B25

Kernel version:

Darwin Kernel Version 14.0.0: Fri Sep 19 00:26:44 PDT 2014; root:xnu-2782.1.97~2/RELEASE_X86_64

Kernel UUID: 89E10306-BC78-3A3B-955C-7C4922577E61

Kernel slide:     0x0000000023400000

Kernel text base: 0xffffff8023600000

__HIB text base: 0xffffff8023500000

System model name: MacBookAir5,2 (Mac-2E6FAB96566FE58C)

System uptime in nanoseconds: 28342824048697

last loaded kext at 11336649560858: com.apple.driver.AppleUSBCDC 4.2.2b5 (addr 0xffffff7fa602d000, size 20480)

last unloaded kext at 11396745628393: com.apple.driver.AppleUSBCDC       4.2.2b5 (addr 0xffffff7fa602d000, size 16384)

loaded kexts:

com.sophos.kext.sav      9.2.50

com.sophos.nke.swi        9.2.50

:1020591


This thread was automatically locked due to age.
Parents
  • 0

    It's a good idea to post long log extracts using the 'Insert Code' option on the toolbar in the posting editor.

    Users do post that SAV is the cause and from my experience the thing that makes them decide it's SAV is because SAV is nearly always mentioned in the report.  That's because SAV is always running to protect the computer and then errors during a crash - whether it caused it or not.

    I'm not saying SAV isn't causing it.  However if it was purely SAV more/all users would be reporting it.  To investigate this further you need to consider (a) is it SAV or not, and (b) if it's SAV what else is running or what am I or the computer doing just before the crash?

    To test it may be worth disabling the on-access scanner for a few days to see if a crash still occurs.  If it does try installing SAV and repeating.  If it doesn't switch the on-access scanner back on and see if the error comes back.  Obviously be careful browsing and clicking on things you don't trust while testing.

    Other steps can be to reboot the computer, disabling any programs that start automatically during boot/logon that you don't require, creating a second user account and use that for a few days to see if it's only affecting your profile, and of course: running disk utility to check the check of the hard drive.

    The important thing is to be sure it is SAV on it's own, or in combination with another program you have running that is causing the crash.  Once we know that we can take the next step.

    :1020706

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply
  • 0

    It's a good idea to post long log extracts using the 'Insert Code' option on the toolbar in the posting editor.

    Users do post that SAV is the cause and from my experience the thing that makes them decide it's SAV is because SAV is nearly always mentioned in the report.  That's because SAV is always running to protect the computer and then errors during a crash - whether it caused it or not.

    I'm not saying SAV isn't causing it.  However if it was purely SAV more/all users would be reporting it.  To investigate this further you need to consider (a) is it SAV or not, and (b) if it's SAV what else is running or what am I or the computer doing just before the crash?

    To test it may be worth disabling the on-access scanner for a few days to see if a crash still occurs.  If it does try installing SAV and repeating.  If it doesn't switch the on-access scanner back on and see if the error comes back.  Obviously be careful browsing and clicking on things you don't trust while testing.

    Other steps can be to reboot the computer, disabling any programs that start automatically during boot/logon that you don't require, creating a second user account and use that for a few days to see if it's only affecting your profile, and of course: running disk utility to check the check of the hard drive.

    The important thing is to be sure it is SAV on it's own, or in combination with another program you have running that is causing the crash.  Once we know that we can take the next step.

    :1020706

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
No Data
Unfiltered HTML