Sophos Scan service on macOS stops running

The Sophos Scan services stops running sporadically even though all permissions are set. We use MDM to deploy Sophos Endpoint to a number of Macs running macOS 12 thru 14. When Sophos is deployed, we can confirm all services are running and have the green check on both the Mac and in Sophos Central. Devices will be fine for sometime, updates and scheduled scans occur regularly. Suddenly, with out rhyme or reason, the Sophos Scan service will appear as red and 'Not Running.'

When this happens we navigate to the Security & Privacy to double check the permissions are all set. We also open the Sophos Endpoint from the menu bar and see it is red. Next we click on 'Open Sophos Endpoint... > About in the bottom right corner > Run Diagnostic Tool.' Here the only section that is red is 'Services,' and the only service not running is 'Sophos Scan.' After a few seconds, (under a minute each time), Sophos Scan turns green and start running. In Sophos Central it also turns green after a few moments. 

There doesn't seem to be a cause here, or even a reason it stops running at all. Can this be investigated? We have multiple clients this happens to week in and week out. Even as I write this, it just occurred on my Mac. Screenshots below are from my Mac, but this is how it occurs on user Macs every time.



Added Tags
[edited by: GlennSen at 12:49 AM (GMT -7) on 26 Mar 2024]
Parents
  • Hi Edwin,

    Thanks for reaching out to the Sophos Community Forum. 

    I suggest opening a Sophos Support Case regarding your issue. Please also include development ticket ID "MACEP-8591," as your symptoms appear to match. 

    The Sophos Health component may incorrectly read the service state. While the UI may report that the service is stopped, it will remain running in the background, and the status will typically correct itself within an hour. 

    By opening a Sophos Support Case, you can ensure you are notified about any upcoming hotfixes/early releases to rectify this issue as soon as they are made available. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply
  • Hi Edwin,

    Thanks for reaching out to the Sophos Community Forum. 

    I suggest opening a Sophos Support Case regarding your issue. Please also include development ticket ID "MACEP-8591," as your symptoms appear to match. 

    The Sophos Health component may incorrectly read the service state. While the UI may report that the service is stopped, it will remain running in the background, and the status will typically correct itself within an hour. 

    By opening a Sophos Support Case, you can ensure you are notified about any upcoming hotfixes/early releases to rectify this issue as soon as they are made available. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Children
No Data