This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSPService, high memory usage in win10 - multiple systems

Hey all,

SSPService.exe is bringing numerous windows 10 pro machines to a crawl in my department where the memory usage is 99-100% as seen under Processes in the task manager.  This appears to be 100% of the time.  

What is the current solution?  These machines are all on latest updates for Sophos and windows.   

Thanks,

matt



This thread was automatically locked due to age.
Parents Reply Children
  • As one example of many where sophos is running non-stop in high usage.

  • Hi Glenn

    Case #: 31053031

    Screenshots below are what we are observing on our endpoints, with a fully up to date sophos client at the time.

    The other problem we encountered is that one some of these endpoint once they are rebooted, multiple installed application are no longer working, google chrome, adobe, office all need to be reinstalled and in some cases file explorer also is not working, for these workstations we reloaded in order to save time as we make use of autopilot/intune.

    As for our case, we are following what I assume is a standard troubleshooting guide of disabling services one by one and restarting the endpoint, this then takes a lot of time for the issue to reappear as the reboot sorts out the high memory usage and we have to wait for it to return to the problematic state before continue on to the next step.

    Matt are you experiencing any of the corrupt OS/application symptoms?

    Another endpoint:

  • I would try disabling behavioural protection in the threat protection policy as that could account for some of the CPU usage of SSPService.exe.

    Following that, just run Process Monitor with a filter for process sspservice.exe, it might be apparent straight away where all the time is spent. A couple of minutes when you have the issue should be quite revealing I would think. Might hint at possible exclusions for example.

    Otherwise, for full details, capture the issue with a ETL trace, from an admin prompt:

    wpr.exe -start GeneralProfile

    Leave for a couple of minutes when the CPU usage is occurring, then run

    wpr.exe -stop C:\genp.etl

    Support should be able to work out what's going on with the C:\genp.etl ETL trace given they have the symbols. If you load it in Windows Performance Analyzer it should be possible to work out roughly what's going on without the Sophos symbols loaded but with the Microsoft ones.

  • several of my users facing this similar issues currently.  found a bit weird. only recently.