Thread Info
  • State Not Answered
  • Replies 2 replies
  • Subscribers 4 subscribers
  • Views 912 views
  • Users 0 members are here
Options
Suggested

Exclusion for SophosFileScanner in Windows start-up phase

NXKI

Hello all,

is there a way to tell the SophosFileScanner not to slow down the windows startup process this much ?

Regarding Microsoft Intune reporting this service is slowing down the startup process by 14 Seconds~.

Can we maybe set and exclusion we didnt set yet ? I know that Sophos needs to scan things during startup but 14 seconds is huge. Even if we can split it to 7 seconds it would be an improvement.

Thank you very much Slight smile

  • 0

    Thank you for reaching out to the community forum. 

    You can try checking out this article to look for additional files being scanned or what activities Sophos File Scanner is performing.- Sophos File Scanner Performance: What's being Scanned/What to Exclude

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0

    I would suggest, stop the "Sophos File Scanner Service" service.

    Enable "Scan Summaries" logging for SophosFileScanner.exe.  You can do this in Endpoint Self Help (ESH), or just create the DWORD LogLevel to 0 under:
    HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Logging\SFS\Scan Summaries

    Reboot.

    Next time the computer starts, SophosFileScanner.exe (worker) will start, and due to the additional logging, log to a CSV under:
    \Programdata\Sophos\Sophos File Scanner\

    Once you are happy you have captured the startup and login. 
    Delete the LogLevel  DWORD to stop the additional logging to the CSV. I would do this as quickly as possible once the user has logged on and the desktop is usable.

    You can then look at the CSV in Excel, to identify:
    Scan times for files, e.g. sort by highest to lowest. Anything specific taking a long time?
    Create a Pivot table grouping by path, to see if one or more files are repeatedly scanned.

    This data should provide what you need from a scanning perspective and might give you some exclusions to try.
    HTH

Unfiltered HTML