10.0.4 Network Extension App - Excessive CPU Usage

We had identified and fixed the issue that we believed was causing the excessive CPU usage with the Network Extension app but as many of you are still encountering the problem there is obviously something else going on, something that we've so far been unable to reproduce.

We've started this thread to collect and collate the details on the occurrences of this on 10.0.4 and as a place to post your SDUs.

We still believe that network connectivity issues and the high CPU are unrelated as the Network Extension app is not directly involved in network activity, as it behaves as a watcher to the actual network extension which is what performs the actual interception.

Thank you for your continued feedback and your patience.

Parents
  • I have 1 Big Sur user with 2018 Macbook Pro 15" on MacOS 11.2.3 who is on Sophos 1.0.4, reporting com.sophos.endpoint.networkextension using 100% CPU (an entire core). Symptoms are: 

    • If a web page request doesn’t completely timeout it will load incompletely.
    • Laptop fans will spin up. 
    • Auto-hidden dock will no longer appear. (I don’t know how that’s connected but it’s reproducible.)

    It’s been happening every few days now.

    Problem returns after force quitting com.sophos.endpoint.networkextension, and then seems to get process com.cisco.anyconnect.macos.acsosc... involved with high CPU usage, though, Anyconnect was not being used at the time.

    I will open a support ticket. Note that we are evaluating JAMF Protect going forward, as it is integrated with our JAMF MDM, uses native MacOS functionality, and hopefully won't be as unstable as Sophos, while providing more actionable information. 

Reply
  • I have 1 Big Sur user with 2018 Macbook Pro 15" on MacOS 11.2.3 who is on Sophos 1.0.4, reporting com.sophos.endpoint.networkextension using 100% CPU (an entire core). Symptoms are: 

    • If a web page request doesn’t completely timeout it will load incompletely.
    • Laptop fans will spin up. 
    • Auto-hidden dock will no longer appear. (I don’t know how that’s connected but it’s reproducible.)

    It’s been happening every few days now.

    Problem returns after force quitting com.sophos.endpoint.networkextension, and then seems to get process com.cisco.anyconnect.macos.acsosc... involved with high CPU usage, though, Anyconnect was not being used at the time.

    I will open a support ticket. Note that we are evaluating JAMF Protect going forward, as it is integrated with our JAMF MDM, uses native MacOS functionality, and hopefully won't be as unstable as Sophos, while providing more actionable information. 

Children