Sophos System Protection Service restarted/stopped loop" - Windows Update

Hi MysteriousDT,

Thanks for reaching out to the Sophos Community Forum. 

Let me know if you can share your case number(s) with me via Private Message. I was not able to locate any open cased associated to your email when taking an initial look. 

To gather logging on the service stop, I'd suggest using Procdump. You can use the following command line to begin monitoring for the SSP stop/crash.
- procdump -ma -i c:\dumps 
OR
- procdump -ma -i

Once a log is generated, I suggest also gathering an SDU log from the affected system so we can take a closer look. 

We now have the same issue, however it is on Windows Server 2019.

Did you found out how to resolve this?

Hi!

SOPHOS support solved the problem a while ago.

Solution: Remove Sophos certificate from AD GPO deployment.
( Example: Sophos CA cert, this casues some service flapping on the Sophos Endpoint client - this bug will be fixed to the upcoming version - they said ).

Thanks for your reply!
I tried removing the certificates and it seems to have worked.

It 's clearly not patched in between, since we're on the 'Sophos recommended version':

Every 2 hours we saw a restart of the services:

I can confirm the exact same Issue. Uninstall and re-protect do nothing to stop it.  Also noticed the Memory is over committed and balloons and consumes all available until the service stops!

Hi Scott, 

Version 2023.1 of Sophos Core Agent will include a fix for the memory-leak-like symptoms you're experiencing. The updated version will finish rolling out to customers over the coming few weeks.

If this is causing significant issues in your environment, I'd suggest opening a support case with our team so you can request to be moved to an earlier release group once your issue is verified.

Feel free to send me a private message with your case number as well so I may follow up with our team.

Thanks Kushal, I DM 'd you. I have an open ticket for the SPlashtop issue and have sent you that ticket. If I need to open a new Case I will to request the early release.