Version 9.5.2 Released Today

The automatic update to 9.5.2 went unnoticed until some wrinkles made me check the Sophos version (I hadn't installed 9.5.2 on my production machine, just a test machine for beta testing).

First, in System Preferences>Keyboard>Shortcuts, another line for "Scan with Sophos Anti-Virus" has been added and both it and, I guess, the earlier Sophos version now have their own lines when the user right-clicks on a file to view Services options, and to invoke a scan. The wrong choice simply returns nothing. But it also triggers the "syslogd" process which was consuming 155% of CPU for nearly 40 seconds and tended to slow down the Mac (I have 12 cores so it wasn't crippling).

Second, in that function, the scan setting which selects scanning for Adware and PUA's when scanning via right click Process>Scan with Sophos (which I discovered some months ago and turned on) was turned off after the update.

Third, I didn't realize that the update had occurred and only discovered it after trouble-shooting that right click scan failure. Is there some way of notifying Sophos users when an update this extensive occurs in the background? One reason is that I suspect the Mac and Sophos would probably both benefit from a reboot for such a major change.

On the plus side, thank you for releasing this version. I was getting to the point of installing the "Preview" on my main Mac.[;)]

Howdy,

Thanks for the feedback. In general we are pretty happy when upgrades happen without complications, but sounds like it didn't go exactly perfectly this time around for you. Sorry about that, definitely not what we hoped.

The Shortcuts thing is a constant pain to get right. 9.5 changed the way it works quite a bit (we don't launch the full UI for it any more), and the system doesn't always like to "forget" about the old settings. Best workaround is to uncheck the one you don't want. I'll ask one of my developers to see if there is a way to clean that up better.

Also a bit weird about the PUA configuration, the setting should have been preserved across the update. Did you notice any other configuration changes?

Good feedback about the announcements. We might be able to put something into the product.

bobcook said:

...The Shortcuts thing is a constant pain to get right. 9.5 changed the way it works quite a bit (we don't launch the full UI for it any more), and the system doesn't always like to "forget" about the old settings. Best workaround is to uncheck the one you don't want...

Oddly enough, before the 9.5 update, I already had two Sophos shortcuts (probably from 9.4 and a still earlier version) but they both worked so I never gave it much thought. With 9.5.2 I had three Sophos shortcuts and only one worked. The solution was to turn only one on at a time and test it to see which worked, then leave the rest off so only one appears in the Services list. Notably, on my system at least, of the three shortcuts in the System Preferences list, only the middle one worked.

I haven't noticed any other configuration changes but I do note that turning On-Access scanning off and on is much faster.

Nothing is ever simple. But I'm glad 9.5.2 has been released.

If you right-click on the Services item (System Preferences > Keyboard > Shortcuts > Services) and select Show in Finder it will highlight the application which registered the service. The only "correct" one is /Library/Sophos Anti-Virus/SophosUIServer.app.

There isn't a nice system API to unregister them. Supposedly the system figures out which ones can be removed when the software is removed, but it seems a bit flakey.

In 9.5 we moved the service from the main GUI application (/Applications/Sophos Anti-Virus.app) to the SophosUIServer.app to avoid having to launch the full app when you run a scan. The SophosUIServer.app is the thing that makes the Sophos shield menu, and thus is always running when you log in.

Hope that helps.

Since this new update, Sophos always shows "Up To Date" as greyed out . . . even after numerous attempts to "Update Now" . . . About Sophos is showing version 9.5.2 and threat detection 3.65.2, but still the dropdown menu seems to be indicating it is not up to date . . .  I'm running Mac OSX 10.11.6 on a Mac Mini.

The first menu item in the Sophos shield menu is always grey - its a status message not a command. Its always worked like this. If it says "Up To Date" you are good. You can also check the log file "/var/log/install.log" for messages from the Sophos Installer about the last time it ran. Should happen several times a day.

Hope that helps.

Great uodate, it apparently just killed off my ages old Sophos install (carried over from OS X 10.5). Things stopped since today.

Cant figure whats wrong, getting all of such messages:

"Sophos AutoUpdate is not running"

"Sophos Anti-Virus Preferences Error"

"Configuration daemon is not running."

[saw another user, writing "Configuration daemon not running'], see here

In Console, SophosManagementAgent there"s lines repeating endlessly:

ClientConnection::Reconnect()
26.08.2016 02:17:42 0C57 W MSClient::Connect: failed to get router's IOR from supplied address and port.
26.08.2016 02:17:42 0C57 W NoRouterIORException: Caught MSClient::Connect: failed to get router's IOR from supplied address and port.
ClientConnection::Reconnect()
 

other strange logs in Console (SophosMessageRouter):

26.08.2016 04:21:18 0C8D W Failed to get certificate, retrying in 600 seconds
26.08.2016 04:31:53 0C8D I Getting parent router IOR from 129.132.1.28:8192
26.08.2016 04:33:08 0C8D I Getting parent router IOR from mathilda:8192
26.08.2016 04:33:08 0C8D E ACE_INET_Addr::ACE_INET_Addr: mathilda: Undefined error: 0
26.08.2016 04:33:08 0C8D W Parent address unknown: Undefined error: 0 (0)
26.08.2016 04:33:08 0C8D I Getting parent router IOR from mathilda:8192
26.08.2016 04:33:08 0C8D E ACE_INET_Addr::ACE_INET_Addr: mathilda: Undefined error: 0
26.08.2016 04:33:08 0C8D W Parent address unknown: Undefined error: 0 (0)
26.08.2016 04:33:08 0C8D E Failed to get parent router IOR
26.08.2016 04:33:08 0C8D W Failed to get certificate, retrying in 600 seconds

In recent days my Time Machine backups have been very slow. After some experimentation, I think it is related to Sophos.

I have a USB3 WD Passport, encrypted. My main HD (MBP, SSD, El Cap) is also encrypted. The TM drive is on the Sophos excluded list.

Time Machine will start, but will backup about 1.9 MB in 30 minutes.

If I turn off Sophos, the backup runs at the normal rate (~ 5Gb in 10 min).

Are there any logs I can collect for Sophos to trouble shoot? My gut tells me it is related to the internal SSD in the MBP, not the external TM, but I cannot be sure.

I have noticed the same issue with TM backups and the upgrade to Sophos 9.5.2.

I leave Time Machine’s automatic backup off. I initiate a manual backup (Back Up Now) normally once a day when any work files have largely been saved to disk. The typical daily backup amounts to 2GB or less and has, for years, generally taken a couple of minutes at most with the backup “Count-Up” display moving pretty quickly, jumping many MB’s at a time.

Starting immediately after the upgrade to Sophos 9.5.2, the time required to backup has grown substantially and the backup speed has dropped sharply especially at the beginning of the process with progress registered in KB's rather than MB's. It’s as if many very small files are being processed with much more “attention” than previously since what’s getting backed up hasn’t changed much except, perhaps, for what the 9.5.2 upgrade has introduced.

Activity Monitor doesn’t show anything special going on. And Time Machine is on a different HD on the same SATA bus as the boot SSD.

However, starting a manual backup just now with Sophos On Access scanning on runs very slowly (actually showing bytes for the first time ever); turning it off during the process speeds it up noticeably, and turning it back on slows it down again.

Since my Mac was updated to 9.5.2 a lot of "SophosDignostic.gz" files are created in the log folder. I can see this behavior on three Macs.

By the way i can also confirm that Time Machine backup are very slow since 9.5.2