Configuring VPN Remote Access for the first time on your Sophos XG Firewall? Check out this useful Community post!
Advisory: Sophos XG Firewall - Antivirus service stopped due to failed pattern update. Please visit this KBA for the latest updates
This article provides information on the Sophos provided change to alleviate intermittent backup failures where the Sophos Health component is installed.
Following investigations, working with Microsoft and third-party backup vendors, we have established that the way in which the Sophos Health Service (part of the Sophos Endpoint Agent) writes to the Windows registry, has uncovered a behavior in Windows that can intermittently result in a backup failure.
The underlying issue in Windows affects the Volume Shadow Copy Service (VSS) as commonly used by the built-in Windows backup tool and third-party backup software.
Additional details regarding this issue can be found in the Microsoft article VSS_WS_FAILED_AT_FREEZE error when you try to make a VSS shadow copy.
Microsoft has confirmed that the Sophos product is using the registry APIs correctly (it is therefore possible that other non-Sophos products could also fall foul of this bug). However, we appreciate that this situation is causing significant inconvenience to some Sophos customers and have therefore made a change to help workaround this issue in Windows.
The following Event can be logged if this issue is being seen:
A VSS writer has rejected an event with error 0x800423f2, The writer's timeout expired between the Freeze and Thaw events. Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer. Operation: Thaw Event
Applies to the following Sophos product(s) and version(s) Central Server Core Agent 2.0.2
The following registry change can be made to increase the default polling time used by the Sophos Health Service to a level that exceeds that which triggers the issue. On an affected server:
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable for us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.