Sophos Endpoint - Service Sophos Autoupdate stopped

Question

Hello, 
 
 we often have the problem with the service Sophos Autoupdate stopped. Sophos Enpoint is in error state until we re start the service manually (or restart the computer).

Can you help me to find a definitive solution? Thanks !

jak · Accepted Answer

There is no error, but I find it odd looking at these 4 service starts followed by the service stopping. 
 Note : The message: "Shutting down before expiry of startup delay", suggests that the service has stopped within 5 minutes of startup as 5 mins is the default startup delay. 
 ===== 2020-01-27T13:59:36.197Z [ 5340: 5344] [v6.1.356.0] INFO Sophos Update Service is starting. 2020-01-27T13:59:36.197Z [ 5340: 5344] [v6.1.356.0] INFO AutoUpdate version : 6.1.356.0 2020-01-27T13:59:36.197Z [ 5340: 5344] [v6.1.356.0] INFO susvc version : 6.1.356.0 2020-01-27T13:59:36.198Z [ 5340: 5344] [v6.1.356.0] INFO Build : 20190830114005-95a0922451e171e9dc54e46773bc3633f4b6b20b 2020-01-27T13:59:36.198Z [ 5340: 5344] [v6.1.356.0] INFO ========================= 2020-01-27T13:59:36.198Z [ 5340: 5344] [v6.1.356.0] INFO Set process security... 2020-01-27T13:59:36.198Z [ 5340: 5344] [v6.1.356.0] INFO Initialising module... 
 2020-01-27T13:59:54.930Z [ 5340: 6968] [v6.1.356.0] INFO Shutting down before expiry of startup delay 
 18 seconds after starting, the service is stopped 
 
 Example 2: 
 ===== 
 2020-01-27T15:13:07.234Z [ 5392: 5396] [v6.1.356.0] INFO Sophos Update Service is starting. 2020-01-27T15:13:07.234Z [ 5392: 5396] [v6.1.356.0] INFO AutoUpdate version : 6.1.356.0 2020-01-27T15:13:07.235Z [ 5392: 5396] [v6.1.356.0] INFO susvc version : 6.1.356.0 2020-01-27T15:13:07.235Z [ 5392: 5396] [v6.1.356.0] INFO Build : 20190830114005-95a0922451e171e9dc54e46773bc3633f4b6b20b 2020-01-27T15:13:07.235Z [ 5392: 5396] [v6.1.356.0] INFO ========================= 2020-01-27T15:13:07.235Z [ 5392: 5396] [v6.1.356.0] INFO Set process security... 2020-01-27T15:13:07.235Z [ 5392: 5396] [v6.1.356.0] INFO Initialising module... 
 2020-01-27T15:13:18.140Z [ 5392: 6620] [v6.1.356.0] INFO Shutting down before expiry of startup delay 
 11 seconds after starting, the service is stopped 
 ===== 
 Example 3 
 ===== 
 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO Sophos Update Service is starting. 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO AutoUpdate version : 6.1.356.0 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO susvc version : 6.1.356.0 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO Build : 20190830114005-95a0922451e171e9dc54e46773bc3633f4b6b20b 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO ========================= 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO Set process security... 2020-01-28T07:58:35.972Z [ 5304: 5308] [v6.1.356.0] INFO Initialising module... 
 2020-01-28T07:58:50.922Z [ 5304: 6592] [v6.1.356.0] INFO Shutting down before expiry of startup delay 
 25 seconds after starting, the service is stopped 
 ===== 
 2020-01-28T08:24:15.499Z [ 5292: 5296] [v6.1.356.0] INFO Sophos Update Service is starting. 2020-01-28T08:24:15.499Z [ 5292: 5296] [v6.1.356.0] INFO AutoUpdate version : 6.1.356.0 2020-01-28T08:24:15.500Z [ 5292: 5296] [v6.1.356.0] INFO susvc version : 6.1.356.0 2020-01-28T08:24:15.500Z [ 5292: 5296] [v6.1.356.0] INFO Build : 20190830114005-95a0922451e171e9dc54e46773bc3633f4b6b20b 2020-01-28T08:24:15.500Z [ 5292: 5296] [v6.1.356.0] INFO ========================= 2020-01-28T08:24:15.500Z [ 5292: 5296] [v6.1.356.0] INFO Set process security... 2020-01-28T08:24:15.500Z [ 5292: 5296] [v6.1.356.0] INFO Initialising module... 
 2020-01-28T08:24:33.329Z [ 5292: 6924] [v6.1.356.0] INFO Shutting down before expiry of startup delay 
 18 seconds after starting it's stopped. 
 ====== 
 It would be interesting to correlate the computer starting up with these logs. For example, the service could start on update if the AutoUpdate component updates itself which isn't very often and from the log provided it's all the same version in these logs. 
 So I have to assume that the computer has started up, the Sophos AutoUpdate service has started but then, 18, 11, 25 and 18 seconds later the service has stopped. The AutoUpdate service is an auto-start service, so as part of the startup I believe a process is stopping it, maybe a startup script. I would probably gather a Process Monitor boot trace of the computer to see what processes/scripts get executed when the service is stopped. You should see a process exit event for alsvc.exe as a way of seeing when the service stops. The problem should be between the Process Start for alsvc.exe and the process exit. 
 Regards, 
 Jak