10.0.3 "Sophos Network Extension" process using 150% CPU

I'm happy to say that we have identified the issue with the high CPU usage for the Sophos Network Extension process and will be included in our GA release.

Thank you for all the feedback, it really is appreciated, and we apologize for the inconvenience.

Will this fix be available in the current EAP before GA?

Unfortunately there won't be an update to the EAP before GA which begins rollout next week at which point both EAP and GA lines will update together. If you can provide us with your updating credentials we can move you into the first rollout group, expected to release on Tue 23rd.

In the meantime, we can offer a workaround to disable the network extension. In Central amend, or create new, policies to disable:

• Threat Protection
  

  • • Real-time Scanning - Internet

      • Scan downloads in progress
      • Block access to malicious websites
    • Remediation
      • Enable threat case creation
      • Protect network traffic
• Web Control
  • Disable Web Control 

Once the features are disabled rebooting the machine will ensure the network extension is not loaded.

I understand how frustrating this can be and we really do value your feedback and your patience.

Hi David, will this release to GA also update the client on macOS 10.15.x to v10.0.3? or will those Macs stay at v10.0.1?

Thanks

Another question: Is a fix for the VPN issue pending in the GA?

I don't understand the reasoning here. The Whole purpose of the EAP is to allow "customers to test the macOS features and functionality with macOS 11 Big Sur." By not patching the EAP, you are releasing untested code to all clients. How are we supposed to test and make sure it is a viable fix?

Will the Time Machine issue also be fixed?

All endpoints will update to 10.0.4, which will operate with either kernel or system extensions depending on the version of macOS.

I assure you we wouldn't release untested code. The intention behind the EAP is to allow customers to test the features in their environment and provide real-world feedback on environments and configurations that we otherwise might be unable to test. In the case of this network extension issue, there is a clear indication of the cause in the SDUs the community has provided and we have been able to use that knowledge to reproduce in-house. The team is hard at work on implementing and testing fix and with the GA release dates imminent, rollout starting on the 23rd, it made sense to target that rather than delay any further. The GA version will be being released to both EAP and GA lines together so no action is required to get the update.

I assure you we wouldn't release untested code. The intention behind the EAP is to allow customers to test the features in their environment and provide real-world feedback on environments and configurations that we otherwise might be unable to test. In the case of this network extension issue, there is a clear indication of the cause in the SDUs the community has provided and we have been able to use that knowledge to reproduce in-house. The team is hard at work on implementing and testing fix and with the GA release dates imminent, rollout starting on the 23rd, it made sense to target that rather than delay any further. The GA version will be being released to both EAP and GA lines together so no action is required to get the update.

Hmmm. Still waiting on an update that doesn't cripple the network connections of fill the RAM/hard drive. Any news?