Huge folder sophos\endpoint defense\data\event journals\sophosED

Question

Checking disk space consumers on our windows servers we see that Sophos folder is huge on them: 
 %programdata%\sophos\endpoint defense\data\event journals\sophosED 
 Some of the subfolders contain tenthousands of files (e.g. Dns or FileBinaryChanges sub-folder) , some folders contain files, that are more than 2 years old. 
 Who is doing the housekeeping here? That mess slows down backups and other tasks. 
 one server:

other server:

LuCar Toni · Accepted Answer

There will be an option to configure this amount in Central in the future. 
 But the max value should be 5GB. See: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/GlobalSettings/EventJournals/index.html 
 You could create a case, so somebody could look into this, why your logs are increasing and not rotate correctly.

Sophos User930 · Answer

SEDService.exe ("Sophos Endpoint Defense Service") performs the housekeeping of these files and runs every 4 or 5 mins to perform this task. It compresses the current .bin file to .xz for example and keeps the size of each journal under the max size which are defined here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EventJournal\Subjects You can see the max size of each journal subject and if you total up all the values: Name Property ---- -------- DirectoryChanges MaxDiskUsageMB : 219 Dns MaxDiskUsageMB : 219 FileBinaryChanges MaxDiskUsageMB : 437 FileBinaryReads MaxDiskUsageMB : 437 FileDataChanges MaxDiskUsageMB : 219 FileDataReads MaxDiskUsageMB : 219 FileHashes MaxDiskUsageMB : 219 FileOtherChanges MaxDiskUsageMB : 219 FileOtherReads MaxDiskUsageMB : 219 FileProperties MaxDiskUsageMB : 219 Http MaxDiskUsageMB : 219 Image MaxDiskUsageMB : 219 Ip MaxDiskUsageMB : 219 Network MaxDiskUsageMB : 219 Process MaxDiskUsageMB : 437 ProcessProperties MaxDiskUsageMB : 219 Registry MaxDiskUsageMB : 219 System MaxDiskUsageMB : 219 Thread MaxDiskUsageMB : 219 Url MaxDiskUsageMB : 219 WinSec MaxDiskUsageMB : 219 18*219 + 3*437 = 3942+1311= 5253 MB. --- In Central you could half this size, e.g. To: Once the policy arrives at the client: C:\ProgramData\Sophos\Management Communications System\Endpoint\Cache\CORC37.policy 2625 The registry values are changed to: Name Property ---- -------- DirectoryChanges MaxDiskUsageMB : 109 Dns MaxDiskUsageMB : 109 FileBinaryChanges MaxDiskUsageMB : 219 FileBinaryReads MaxDiskUsageMB : 219 FileDataChanges MaxDiskUsageMB : 109 FileDataReads MaxDiskUsageMB : 109 FileHashes MaxDiskUsageMB : 109 FileOtherChanges MaxDiskUsageMB : 109 FileOtherReads MaxDiskUsageMB : 109 FileProperties MaxDiskUsageMB : 109 Http MaxDiskUsageMB : 109 Image MaxDiskUsageMB : 109 Ip MaxDiskUsageMB : 109 Network MaxDiskUsageMB : 109 Process MaxDiskUsageMB : 219 ProcessProperties MaxDiskUsageMB : 109 Registry MaxDiskUsageMB : 109 System MaxDiskUsageMB : 109 Thread MaxDiskUsageMB : 109 Url MaxDiskUsageMB : 109 WinSec MaxDiskUsageMB : 109 Next time SEDService.exe carries out its work, the max size per subject should be met.

Huge folder sophos\endpoint defense\data\event journals\sophosED

Top Replies