"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
The Sophos Endpoint Security and Control Remote Management System (RMS) log files can be found in the locations below.
Applies to the following Sophos product(s) and version(s) Sophos Endpoint Security and Control
See: Sophos Endpoint Security and Control for Windows: log files for a full list of log files.
To check for error messages in RMS log files, go to the computer in question:
In the RMS log files, error messages are indicated by a letter 'E' in the Type column. For example, the following messages are logged on a workstation:
03.02.2005 12:03:38 05D8 I Getting a new router certificate... 03.02.2005 12:13:39 05D8 I Timed out, resending certification message... 03.02.2005 12:08:28 03CC E Failed to read in the router's IOR from the supplied address and port 03.02.2005 12:08:28 03CC E NoRouterIORException: Caught MessagingSystemClientLib::NoRouterIORException (failed to get router's IOR from supplied address and port) ClientConnection::Reconnect()
For example, the 'Failed to read...' error above indicates that the router on the workstation was unable to connect to the server router and obtain the IOR.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.