Windows computers and server can report an event that Sophos services are missing or not running with a corresponding Critical Health status. The event contains the text One or more Sophos services are missing or not running.
One or more Sophos services are missing or not running
These alerts can indicate two potential issues:
Applies to the following Sophos product(s) and version(s) Sophos Central Admin
You can identify endpoints with this issue by going to the Events Report of Logs & Reports. In the table under Checked items are included in the event results, look for Protection Issues then under it you can find One or more Sophos services are missingor not running or All Sophos services are running.
Another alternative is by going to the Devices page and then filter it by choosing Computers with a medium or bad status or Computers with a bad status to see endpoints that are not reporting a healthy state, which could include issues other than the services that are not started.
For each affected endpoint, you can determine the next step by:
Sophos is aware of the disruption this can cause our customers and we are investigating the underlying causes of all issues and all scenarios that can lead to the issue arising. We have addressed a number of service related issues as follows:
Further analysis and investigation are being performed on any other service related issues and this article will be updated as soon as more information becomes available.
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable for us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.