MacOS slowdowns with EAP in Monterey (solved) and extremely slow login with both Big Sur and Monterey

The MacOS Intercept X has some serious problems. (I'm running the latest EAP 10.3.0.)

The last update to Big Sur 11.16.1 went well, but then my first login after the update took 45 minutes to get to the point that all of my apps were up. Ridiculously slow. This was with the current non-EAP version.

Same with Monterey, using Intercept X EAP. It took 15 minutes to get from the login screen to my desktop, and then I went to bed it was taking so long for the applications to fully launch.

Right now, the networkextension is running at 200% CPU continuously, even when network traffic is low, so my fan is running continuously:



Updated title
[edited by: Wayne Folta at 5:19 PM (GMT -7) on 28 Oct 2021]
Parents
  • We, also, have had terrible performance with Intel macs, running the latest version of the agent (10.3.3).  Symptoms include such sluggishness that apps can not be opened, not even a terminal window.  The laptops are on the latest version of macOS (12.3.1) and the latest version of Sophos (10.3.3).  The symptoms immediately disappear if I remove Sophos from the machine.

  • Yes, we have an open case with Apple Enterprise support, and they pointed to some entries in the macOS logs that appear regularly every 30 seconds. Here is an example below. This is with the recently released Sophos Central 10.3.4 also on macOS 12.3.1 and Intel MacBook Pros, Mac minis, or iMacs. We have also found that the sluggishness seems to go away if Sophos is uninstalled.

    [172805.848780]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCleanD) (pid: 31042): (SophosCleanD) is hardened, (SophosCleanD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.851096]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosScanD) (pid: 31041): (SophosScanD) is hardened, (SophosScanD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.853417]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosAutoUpdate) (pid: 3923): (SophosAutoUpdate) is hardened, (SophosAutoUpdate) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.855708]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCryptoGuar) (pid: 3922): (SophosCryptoGuar) is hardened, (SophosCryptoGuar) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.857997]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosHealthD) (pid: 3921): (SophosHealthD) is hardened, (SophosHealthD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.860318]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosMcsAgentD) (pid: 3919): (SophosMcsAgentD) is hardened, (SophosMcsAgentD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.862604]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (Sophos Network E) (pid: 3918): (Sophos Network E) is hardened, (Sophos Network E) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.864893]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosEventMonit) (pid: 3915): (SophosEventMonit) is hardened, (SophosEventMonit) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.867180]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosSXLD) (pid: 3914): (SophosSXLD) is hardened, (SophosSXLD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.869466]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosWebIntelli) (pid: 3913): (SophosWebIntelli) is hardened, (SophosWebIntelli) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.871776]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosAntiVirus) (pid: 3912): (SophosAntiVirus) is hardened, (SophosAntiVirus) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.874085]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosConfigD) (pid: 3911): (SophosConfigD) is hardened, (SophosConfigD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.876484]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCBR) (pid: 129): (SophosCBR) is hardened, (SophosCBR) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
Reply
  • Yes, we have an open case with Apple Enterprise support, and they pointed to some entries in the macOS logs that appear regularly every 30 seconds. Here is an example below. This is with the recently released Sophos Central 10.3.4 also on macOS 12.3.1 and Intel MacBook Pros, Mac minis, or iMacs. We have also found that the sluggishness seems to go away if Sophos is uninstalled.

    [172805.848780]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCleanD) (pid: 31042): (SophosCleanD) is hardened, (SophosCleanD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.851096]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosScanD) (pid: 31041): (SophosScanD) is hardened, (SophosScanD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.853417]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosAutoUpdate) (pid: 3923): (SophosAutoUpdate) is hardened, (SophosAutoUpdate) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.855708]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCryptoGuar) (pid: 3922): (SophosCryptoGuar) is hardened, (SophosCryptoGuar) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.857997]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosHealthD) (pid: 3921): (SophosHealthD) is hardened, (SophosHealthD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.860318]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosMcsAgentD) (pid: 3919): (SophosMcsAgentD) is hardened, (SophosMcsAgentD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.862604]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (Sophos Network E) (pid: 3918): (Sophos Network E) is hardened, (Sophos Network E) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.864893]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosEventMonit) (pid: 3915): (SophosEventMonit) is hardened, (SophosEventMonit) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.867180]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosSXLD) (pid: 3914): (SophosSXLD) is hardened, (SophosSXLD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.869466]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosWebIntelli) (pid: 3913): (SophosWebIntelli) is hardened, (SophosWebIntelli) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.871776]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosAntiVirus) (pid: 3912): (SophosAntiVirus) is hardened, (SophosAntiVirus) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.874085]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosConfigD) (pid: 3911): (SophosConfigD) is hardened, (SophosConfigD) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
    [172805.876484]: macOSTaskPolicy: (com.sophos.macendpoint.SophosServiceManager) may not get the task control port of (SophosCBR) (pid: 129): (SophosCBR) is hardened, (SophosCBR) doesn’t have get-task-allow, (com.sophos.macendpoint.SophosServiceManager) is not a declared debugger(com.sophos.macendpoint.SophosServiceManager) is not a declared read-only debugger
Children
No Data