This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Monitoring daily scan log - New Architecture, New log file?

Hello!

We monitor hundreds of servers where Sophos is installed and have started to see the new architecture version rollout, triggering us to make some changes to the Windows Services we monitor. We have also noticed that the log file we check daily for infections at C:\ProgramData\Sophos\Sophos Anti-Virus\logs\SAV.txt is no longer updated or seemingly used anymore, and hoped someone could provide information on the new log file we should be targeting with our RMM system?

Many Thanks.

This thread was automatically locked due to age.

0 Sophos User930 over 1 year ago
If there is a replacement it is

C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log

This is the current log, then the 5 archives: SSP.1.log -> SSP.5.log

Other sources would be:

API to Central

Application Event log

The trail under:

C:\ProgramData\Sophos\Health\Event Store\Trail\

You may wish to test a few detections
Cancel
Vote Up 0 Vote Down

Cancel
0 Qoosh over 1 year ago

If you are using scheduled scans or "On-Demand" scans, the logs can be found in the following location.
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SophosScanCoordinator.txt

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Mark Wolsey over 1 year ago in reply to Qoosh

The SophosScanCoordinator.txt file did seem to me as the one to start using, I will need to run some test detections to determine the regex needed as the contents are alot different to SAV.txt.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User930 over 1 year ago in reply to Mark Wolsey

Can the Application Event log be used as a source as I'm sure all detections can be found there. If not, SSP.log seems like you're best bet.
Cancel
Vote Up 0 Vote Down

Cancel