Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Subscribers 13 subscribers
  • Views 4307 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos System Protection Service restarted/stopped loop" - Windows Update

MysteriousDT

Hi!

We found a strange problem:
- Sophos Endpoint client service stuck in restarted/stopped loop.

We found that, everything was working until some specific Windows Update version.
The Windows and Windows Server also affacted.

We did not found any solution yet nor the Sophos Support.
( Temporal fix: Do not upgrade )


Is there sombeody else who has the same problem?



This thread was automatically locked due to age.
  • 0

    Hi MysteriousDT,

    Thanks for reaching out to the Sophos Community Forum. 

    Let me know if you can share your case number(s) with me via Private Message. I was not able to locate any open cased associated to your email when taking an initial look. 

    To gather logging on the service stop, I'd suggest using Procdump. You can use the following command line to begin monitoring for the SSP stop/crash.
    - procdump -ma -i c:\dumps 
    OR
    - procdump -ma -i

    Once a log is generated, I suggest also gathering an SDU log from the affected system so we can take a closer look. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0

    We now have the same issue, however it is on Windows Server 2019.

    Did you found out how to resolve this?

  • +1 in reply to Obit

    Hi!

    SOPHOS support solved the problem a while ago.

    Solution: Remove Sophos certificate from AD GPO deployment.
    ( Example: Sophos CA cert, this casues some service flapping on the Sophos Endpoint client - this bug will be fixed to the upcoming version - they said ).

  • 0 in reply to MysteriousDT

    Thanks for your reply!
    I tried removing the certificates and it seems to have worked.

    It 's clearly not patched in between, since we're on the 'Sophos recommended version':

    Every 2 hours we saw a restart of the services:

  • 0 in reply to Obit

    I can confirm the exact same Issue. Uninstall and re-protect do nothing to stop it.  Also noticed the Memory is over committed and balloons and consumes all available until the service stops!

  • 0 in reply to ScottMcDonnell

    Hi Scott, 

    Version 2023.1 of Sophos Core Agent will include a fix for the memory-leak-like symptoms you're experiencing. The updated version will finish rolling out to customers over the coming few weeks.

    If this is causing significant issues in your environment, I'd suggest opening a support case with our team so you can request to be moved to an earlier release group once your issue is verified.

    Feel free to send me a private message with your case number as well so I may follow up with our team.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    Thanks Kushal, I DM 'd you. I have an open ticket for the SPlashtop issue and have sent you that ticket. If I need to open a new Case I will to request the early release. 

Unfiltered HTML