Sophos UTM: Decommissioning of obsolete URL categorization services CFFS.Click here for important info.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos File Scanner Hight Hardware Usage


I work in an organisation environment where we have a variety of user laptops and are running Sophos Endpoint.


Core Agent 2022.4.1.1

Sophos Intercept X 2022.1.3.3

We have been experiencing an issue with one device, a Lenovo V15-11L where the Sophos File Scanner task is always running at a high CPU, Memory and Disk rate.

This device has been reset multiple times and the issue remains in place. Please could someone offer some advise on a solution to this as no other devices have experienced any issues with this?

I look forward to hearing from you.

Kind Regards,


This thread was automatically locked due to age.
  • Hi Tamoor,

    Thanks for reaching out to the Sophos Community Forum.

    If you wish to monitor what the Sophos File Scanner process is scanning in real-time, try increasing the log level on the "SFS" component to "info". This can be done from the "Tools" section of the Endpoint Self Help Tool.

    Then you can run the following command through PowerShell to analyze the logs as they are generated.

    Get-Content "C:\ProgramData\Sophos\Sophos File Scanner\Logs\SophosFileScanner.log" -wait -tail 1 | where {$_ -match 'I End ScanDispatcher Request' -and $_ -notmatch 'SophosFileScanner.log'}

    If you have any applications running locally which will perform a high number of read/write operations, such as a database application, you may want to consider adding some Process Exclusions for these as well. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • I have the same Problem with one client. Let me know if you found a solution please

  • Hi There, 

    We have the same issue in our environment. Running Dell and Lenovo Laptops.
    If there is any solution, that would be much appreciated. 


  • Does the suggestion above help to narrow down what is being scanned?

  • Does the suggestion above help to narrow down what is being scanned?

  • Good morning Kushal  ,

    Thank you for your reply on this issue and apologies for the delay.

    The scan didn't really help pinpoint what type of files were being scanned and to be honest the logs continued to load for over 8 hrs.

    I'm not certain on what's causing this. This device has the same software/hardware as the other devices in our environment and it is no different from these at all. This is the only device with this issue.

    I look forward to hearing from you.

    Kind Regards,


  • If the SophosFileScanner.exe process (child, worker process) is using high CPU, it is very likely to be scanning files as that's most of what it does.

    The log files "C:\ProgramData\Sophos\Sophos File Scanner\Logs\SophosFileScanner.log" and the archives logs with Information level enabled will detail what is being scanned. The idea behind the PowerShell command is to tail the log, picking out the files being scanned from the log.

    You would expect that running the above when the CPU was high would reveal, the areas of disk being scanned.

    Another "brute force" option, would be to start with high level exclusions, these could at least prove that an exclusion would help.

    For example, in policy, if you exclude:
    from real-time scanning, I assume the issue goes away?

    If so, change it to:


    Does the issue go away then? The log file approach should avoid this but it is another option.

    With each policy change check the reg value OnAccessExcludeFilePaths under:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\Scanning\Config
    To ensure it has made it.

  • Hi  ,

    When I first discovered this issue on this device, its CPU was running at 100% with both the Sophos Endpoint Defence Software service at 12.4% and the Sophos File Scanner service at 69.8%. At the time this device was running Windows 10.

    After resetting the device completely it was upgraded to Windows 11. Shortly after, the CPU was running at 100% again with the Sophos Endpoint Defence Software service at 10.7% and the Sophos File Scanner service at 79.0%.

    From what you've mentioned, if I go through each folder on the devices C:\ drive and set up exclusions for the folders I should find out when the Sophos services ramp up.

    When setting up exclusions, does this affect all of our devices or can I set up singular exclusions for this device only?

    In addition, from all of the information that I have provided what could be causing this? The device only has one drive, the C:\ drive and it has been reset multiple times. Its running the same software packages as all of our other devices.

    Kind Regards,


  • Create a new threat protection policy and link just this device to it. In that you can define the test exclusions. 

  • Hi  ,

    Thank you for confirming. I will check the device next week when I am onsite again.