After joining the Early Access Program (EAP) for Enhanced Protection/ IPS and AMSI, the endpoint may report a Bad health state due to Sophos Snort service not starting until after a reboot. A reboot is required to complete the install of the new IPS and AMSI components. This occurs in the Core Agent release of 2.5.0 Beta when updating and will be fixed in the next release of the Core Agent in November 2019.
This article describes the steps to resolve this bad health status.
The following sections are covered:
Applies to the following Sophos products and versions Sophos Endpoint IPS
Reboot the endpoint after installing the Early Access Program release if the health status goes into a bad state.
After the reboot, all services should start normally and the health status should return to 'good' or green.
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable to us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.