This article is intended as a follow-on from article Differs from Policy - General and those product-specific articles that link off it.
Applies to the following Sophos product(s) and version(s) Sophos Anti-Virus for Windows 2000+
This step is important to allow the client's Agent logs to record enough verbose information and log the exact sub-component of Sophos Anti-Virus that is differing. Note: Leaving the Agent logs at the verbose level for too long is not normally a problem - the number of logs is fixed at four, and the size of each log at 1MB. Therefore it is better to delay logging gathering until you are sure the comply message has reached the client.
When the sdulogs.sdu has been received, confirm that relevant information has been captured in the Agent logs. With verbose logging enabled the full policy and local configuration will be listed after their respective titles. Check that you have the following two sections of logging:
11.03.2012 09:35:54 0440 D SAVXP Adapter: --==Policy==--: ... ... 11.03.2012 09:35:54 0440 D SAVXP Adapter: --==Config==--: ... ...
If the above information is missing from the Agent logs check:
Beneath the main sections of Policy and Config are the sub-components that make up Sophos Anti-Virus. The following list highlights the main sub-components currently available in Sophos Anti-Virus.
Note: Only those components which are enabled in the policy will show. For example: if application control is not switched on in the policy is will not show in the logs. If it is enabled and the client fails to enable this component, it will be shown.
Approved set - lists all the PUAs that have been approved.
Make a note of which part of the configuration is differing - what you've just done above should only need to be done once.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.