This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Monitoring daily scan log - New Architecture, New log file?

Hello!

We monitor hundreds of servers where Sophos is installed and have started to see the new architecture version rollout, triggering us to make some changes to the Windows Services we monitor. We have also noticed that the log file we check daily for infections at C:\ProgramData\Sophos\Sophos Anti-Virus\logs\SAV.txt is no longer updated or seemingly used anymore, and hoped someone could provide information on the new log file we should be targeting with our RMM system?

Many Thanks.

This thread was automatically locked due to age.

Parents

0 Qoosh over 2 years ago

If you are using scheduled scans or "On-Demand" scans, the logs can be found in the following location.
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SophosScanCoordinator.txt

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Qoosh over 2 years ago

If you are using scheduled scans or "On-Demand" scans, the logs can be found in the following location.
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SophosScanCoordinator.txt

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Mark Wolsey over 2 years ago in reply to Qoosh

The SophosScanCoordinator.txt file did seem to me as the one to start using, I will need to run some test detections to determine the regex needed as the contents are alot different to SAV.txt.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User930 over 2 years ago in reply to Mark Wolsey

Can the Application Event log be used as a source as I'm sure all detections can be found there. If not, SSP.log seems like you're best bet.
Cancel
Vote Up 0 Vote Down

Cancel