High Memory Usage SSPService.exe [55 GB RAM]

Hi Ahmad Almla Rashed ,

Thank you for reaching out to our Community Forum. I suggest starting with this basic troubleshooting steps to identify if there's a specific component that's causing this.

By any chance, are the affected servers using "Splashtop Streamer"?
- Sophos Central Endpoint/Server: Systems exhibit high CPU and RAM usage after updating Splashtop Streamer

Hi Gladys 

No We Don't have this software installed this is just a normal web server

Hi Ahmad Almla Rashed ,

Thanks for confirming. Kindly proceed with the component isolation steps in the article I shared, and let us know if disabling any features improves the memory usage.

Hi Gladys 
I tried to disable Real- time Scanning and Still the Same issue

I Also Ran SDU and here is the logs URL that i am requested to share with you as per the SDU

https://sdu-feedback.sophos.com/prod/d562f77a-4129-45c9-acd2-355792f7bfde_2023-06-14-06-22-39.zip
https://sdu-feedback.sophos.com/prod/d562f77a-4129-45c9-acd2-355792f7bfde_2023-06-14-06-22-35.zip

Hi Ahmad Almla Rashed ,

Thanks for testing that out. Aside from disabling the Real-time Scanning, have you also tried to disable the other components? This will help us narrow down which component is causing the high memory usage.

Thanks as well for sharing the SDU logs. If disabling the components doesn't resolve the issue, we'll also need the Process Monitor logs to see what specific event is causing the issue.

I'd suggest logging a support case and uploading the logs there. Once you already have a case ID, you may also share it here so we can further check.

Hi Ahmad Almla Rashed ,

Thanks for testing that out. Aside from disabling the Real-time Scanning, have you also tried to disable the other components? This will help us narrow down which component is causing the high memory usage.

Thanks as well for sharing the SDU logs. If disabling the components doesn't resolve the issue, we'll also need the Process Monitor logs to see what specific event is causing the issue.

I'd suggest logging a support case and uploading the logs there. Once you already have a case ID, you may also share it here so we can further check.