Sophos Firewall reported computer not sending heartbeat signals

Question

Since November an increasing number of endpoints is reported from Central with "Sophos Firewall SN reported computer not sending heartbeat signals" 
 We upgraded our HQ XG from 18.5.4 to 19.0.1 on Nov 12th but the issue started already before as you can see from the screenshots. 
 Before that, we only received this alerts occasionally. Sometimes the message comes multiple times per day for a machine, then a few days no message is created even if the computer is still in use. 
 What is the issue here? 
 Central Region is Central Europe

One Computer:

LHerzog · Accepted Answer

After several test we can confirm the statement from Tech Support, that Sophos Heartbeat is not compatible with Modern Standby feature of Windows and / or modern Computers. 
 So as customer you have 2 choices to get this worked around: 
 1. Disable modern Standby on the OS of all your client computers: 
 cmd
 powercfg /a
 should report s0 is enabled. s0 is modern standby

regedit
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power]
 New > DWORD (32-bit) Value.
 PlatformAoAcOverride with the value 0
 reboot
 
 cmd
 powercfg /a
 should report s3 is enabled. s3 is classic standby 
 2. disable the mail notification about missing heartbeat in sophos central, and ignore all the alerts that appear on the dashboard through out the day and continue to use the modern standby on the client computers. 
 
 Both workarounds are bad ones. 
 Sophos should get Heartbeat be compatible with current computers and operating systems.

emmosophos · Answer

Hello LHerzog, 
 DEV has some binary ready for NC-111152, I would recommend you to open a case with Support, and you can mention about NC-111152, the case would get to GES and they can confirm is your issue matches NC-111152 and install the binary, to see if this resolves your issue. 
 IF you do this, share the Case ID. 
 Regards,

LHerzog · Answer

Hi Qoosh and thanks for your message. 
 The NICs, LAN or WiFi, may be shot down by the OS to save energy. That option is not disabled. 
 As written earlier, it looks to me like the NIC driver does some usless behaviour / dumping something that shows with those Netwtw10 Events every few seconds. That probably wakes the NIC, sends some packets the firewall sees when the heartbeat driver already sent info to the firewall, that the device is now off. 
 After the driver and BIOS updates, the issue has not happened to the computer that was most frequent before. Probably Intel / Fujitsu changed something on the network behaviour in Hibernate. 
 Will continue to monitor the behaviour on our side. 
 Interestingly the events almost stopped completely after Nov 16th.

Sophos Firewall reported computer not sending heartbeat signals

Top Replies