Data Content Records taking up disk space

Question

We have some web servers that has three files called FilePropertyDbFull-xxxxxxxxxxxxxxxxxxxxxxxx.bin that are at getting quite large, currently each is 3.2GB in size.

These servers are just a simple web servers, so not sure why there should be such large files on this particular type of system. Other systems such as File servers with way more files are no where near this size.

They look like they are being cycled on a three day rotation.

What are they, what info do they store, why are they so big on these simple web servers and can they be manged in some way?
Also were these added as part of a recent change?

Can't find any info on FilePropertyDbFull when searching the Sophos Site

added extra tags for memory and non-paged pool
[edited by: Jeremy Roberts at 5:22 PM (GMT -8) on 27 Feb 2024]

EMK · Accepted Answer

Hello, 
 Would I be right in saying this in Sophos Central managed rather than Sophos Enterprise Console (on-premise) management? 
 It looks like: Sophos Known Issues list

WINEP-44248

Core Agent 2023.2

Core Agent

High non-paged pool memory consumption from Sophos Endpoint Defense (pool tags Sg01 and Sg03) 
 
 Windows Servers might show an increased non-paged pool memory consumption from a pool tag labeled Sg01 or Sg03. The memory is allocated by the Sophos Endpoint Defense Data Content Records (used to keep track of PE-file information and SHA-256 values) which get loaded on boot.

None

There must be a lot of changing files on the server to generate such large files. 
 In Core Agent 2023.2, they are purged once you get to that version. 
 They do impact non-paged pool (I suspect if you look in Task manager the non-paged pool is quite high) as mentioned. 
 The files could be removed if you are running out of memory, you can for example: 
 Stop the following services: 
 - "Sophos File Scanner Service" (net stop "Sophos File Scanner Service") - SntpService (net stop SntpService) - sntp (net stop sntp) - "Sophos System Protection Service" (net stop "Sophos System Protection Service") 
 - Unload Sophos Endpoint Defense driver: (fltmc.exe unload "sophos endpoint defense") 
 - Delete the contents of "C:\ProgramData\Sophos\Endpoint Defense\Data\Data Content Records\" 
 Reboot. 
 They will be re-created, it will be interesting to know how quickly they grow from being cleared. It maybe that at the growth rate it will be fine until 2023.2 is on the server. At that point, the computer will need to restart once to get the new version of sophosed.sys loaded. Then the next time it boots with the new software it will start to purge the data. 
 If you can think of any areas on disk where there are a lot of files changes happening that is likely the cause. You mention they are web servers? Do they receive a lot of file or generate a lot of files? Maybe temp ones as part of operation? File/path exclusions for such locations would prevent the growth in the dat files you mention. 
 I hope this information helps. 
 Kind Regards.

Data Content Records taking up disk space

Top Replies