This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSPService.exe consuming huge amounts of RAM

We have had several complaints from different Sophos Intercept X Advanced users that their Windows 10 PCs are running extremely slowly. This has been over the past week or so.

When Task Manager is launched it shows 97% of RAM is used up and a majority of that is by the Sophos SSPService.

When we try to access the PCs via Datto RMM WebRemote or Splashtop the connection is unsuccessful.

If I manually stop the services: Sophos File Scanner, Health, MCS Agent, MCS Client, Network Threat Protection and then EndTask the System Protection Service this reduces the memory usage and allows me to connect remotely. I can the remove Sophos Endpoint to get the machine working again.

This is obviously very much a workaround and my fear is that many more (if not all) of our customers PCs exhibit this behaviour at the same time!

Component versions are Sophos Core Agent v2022.4.3.1 & Sophos Intercept X 2023.1.0.79

Has anybody else come across this yet and if so is there a fix?

Thanks in advance,

Paul.

This thread was automatically locked due to age.

Top Replies

Qoosh 6 months ago +2 verified

Hi Paul , Thanks for reaching out to the Sophos Community Forum. As you mentioned Splashtop, do you know if the devices in question are using "Splashtop Streamer"? I was able to locate the following…

Parents

+1 Qoosh 6 months ago

Hi Paul,

Thanks for reaching out to the Sophos Community Forum.

As you mentioned Splashtop, do you know if the devices in question are using "Splashtop Streamer"?

I was able to locate the following article which may shed some more light on this issue.
- Systems running Sophos Central Server Core Agent exhibit high CPU and RAM usage after updating Splashtop Streamer

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +2 Vote Down

Cancel

Reply

+1 Qoosh 6 months ago

Hi Paul,

Thanks for reaching out to the Sophos Community Forum.

As you mentioned Splashtop, do you know if the devices in question are using "Splashtop Streamer"?

I was able to locate the following article which may shed some more light on this issue.
- Systems running Sophos Central Server Core Agent exhibit high CPU and RAM usage after updating Splashtop Streamer

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +2 Vote Down

Cancel

Children

0 Paul Kavanagh 6 months ago in reply to Qoosh

Hi Kushal,

Thanks for the reply - yes, they are indeed using Splashtop Streamer and on the few that I have checked the version is 3.5.6.0.

I've implemented the suggested fix in the article for the most affected customer - hopefully this is the answer.

I'll come back with an update when I have one.

Thanks again,

Paul.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Kavanagh 6 months ago in reply to Qoosh

Hi Kushal,

We have confirmation this fix works - thank you very much for your help!

Regards,

Paul.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jason Soper 6 months ago in reply to Paul Kavanagh

Hi Paul. I am having the same issue. Question...when you entered the path for the Global Exclusion, did you enter both the long form and short form? I read that sometimes names longer that 11 characters with spaces can cause issues. i.e

C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\

C:\Progra~1\Splashtop\Splash~1\Server\log\

Thanks for the help!

Jason
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Kavanagh 6 months ago in reply to Jason Soper

Hi Jason,

I only entered the long form and that was enough to do the trick.

just remember to include the trailing \ otherwise Sophos takes it as a FILE exclusion.

Regards,

Paul
Cancel
Vote Up +1 Vote Down

Cancel
0 Paul Burke 6 months ago in reply to Jason Soper

Even though the folder exclusion initially fixed the problem for us, we have also today had to add a global exclusion for the process sragent.exe too. Things are back to "normal" again for the moment...
Cancel
Vote Up 0 Vote Down

Cancel
0 Qoosh 6 months ago in reply to Paul Burke

A newer version of Splashtop has been released recently, showing some improvements for customers. I suggest giving this a try if you continue to experience issues.
- Splashtop Version 3.5.8.0

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +1 Vote Down

Cancel
0 ToddHebert 5 months ago in reply to Qoosh

I encountered this very same problem this morning - the patch to the latest version of Splashtop Streamer resolved the issue completely.

Thank you for your post with the solution
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Kavanagh 5 months ago in reply to ToddHebert

Thanks for the update Todd. Great to know
Cancel
Vote Up 0 Vote Down

Cancel