Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 16 replies
  • Subscribers 15 subscribers
  • Views 6795 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

High CPU Usage - SEDService.exe offline

Mori Bir

Hi, I have an annoying problem with the Sophos Endpoint Agent. When I am connected to the internet everything is fine. However, when I unplug the cable and am offline, the load on SEDService.exe goes way up. I have now noticed that under C:\ProgramData\Sophos\Endpoint Defense\Data\Event Journals\SophosED\Dns several .bin files are permanently created 100Mb in size and then zipped as .xz files. This takes a lot of performance and is certainly not the way it should be. Does anyone know the problem or have an idea which setting causes this? As soon as the Internet is available again, the utilization of the process goes down and no more files are created in the path.

There are various blocking entries in the sed log. Do they have anything to do with this?
What could it be?



This thread was automatically locked due to age.
Parents
  • 0
    Mori Bir said:
    when I unplug the cable and am offline, the load on SEDService.exe goes way up

    how long does that take for the process to run with high CPU load?

    I notice that once for a few seconds, whenever I unplug the cable. but it takes some time until this happens. then SEDService.exe uses 100% on one core for about 5-10 seconds.

    I woul dcheck with procmon what is happening during that time. eventually you find a special software (except Sophos) that is runing out of control.

    Eventually a re-installation of the Sophos Agent may also help.

    Please also post your installed Sophos product versions.

  • 0 in reply to LHerzog

    Hi  

    I am still new to working with sophos products.
    Sophos Intercept X 2023.1.1.7 and Core Agent 2023.1.3.5
    Reinstallation did nothing. There are some more devices affected.

    Exactly goes offline and then it takes 5-10sec and the CPU of two cores goes up properly to around 100% exactly.
    And that's where it stays.

    With procmon I then saw this growth of the DNS logs as a .bin file.
    In my case it is also the Windows DNS service and the Windows timer service that have very high CPU usage

  • 0 in reply to Mori Bir

    you could enable DNS logging in event viewer

    Applications and Service Logs >> Microsoft >> Windows >> DNS Client Events >> Operational

    you could also check the Time Service logs there.

  • 0 in reply to LHerzog

    Yes, everything is full of event entries. Several 100mb of logs in a very short time. It always wants to reach the previously internal DNS.

Reply Children
No Data
Unfiltered HTML