Sophos Endpoint Security and Control: Verbose Logging

Hello Peter,

you are talking about the endpoint GUI, arent't you? As you can set the logging level independently for the different components (AV/HIPS, Device Control, and so on) - which one are you interested in? And more important - what do you expect to see and why do you need it?

Christian

Hello Christian,

I want to see the activity of the antivirus component.

We are scanning our NetApp CIFS Share via Sophos Antivirus for NetApp.

For some files, the scan process takes too much time and the result is: Access denied

The log of the "Sophos Antivirus for NetApp" Component only shows:

VS_ScanRequest() reqid is 65589906

CScannerService::HandleScanRequest IN reqID: 65589906

CFilerManager::ProcessScanRequest IN reqID: 65589906

S_ScanRequestStatus() IN reqid is 65589906

CScannerService::HandleScanRequestStatus IN reqID: 65589906

CThreadManagerSingleton::IsRequestFinished IN reqID is 65589906

VS_ScanRequestStatus() reqid is 65589906

.

.

.

CFilerManager::ProceedScanCompletion IN - filepath: <filename deleted>, statusstring: [Code 0, file is clean.

But I do not see, why the scan takes so Long (4 minutes!). I hope to see this in verbose logging of the AV-Component.

Peter

Hello Christian,

I want to see the activity of the antivirus component.

We are scanning our NetApp CIFS Share via Sophos Antivirus for NetApp.

For some files, the scan process takes too much time and the result is: Access denied

The log of the "Sophos Antivirus for NetApp" Component only shows:

VS_ScanRequest() reqid is 65589906

CScannerService::HandleScanRequest IN reqID: 65589906

CFilerManager::ProcessScanRequest IN reqID: 65589906

S_ScanRequestStatus() IN reqid is 65589906

CScannerService::HandleScanRequestStatus IN reqID: 65589906

CThreadManagerSingleton::IsRequestFinished IN reqID is 65589906

VS_ScanRequestStatus() reqid is 65589906

.

.

.

CFilerManager::ProceedScanCompletion IN - filepath: <filename deleted>, statusstring: [Code 0, file is clean.

But I do not see, why the scan takes so Long (4 minutes!). I hope to see this in verbose logging of the AV-Component.

Peter

Hello Peter,

I see. The logs are just logging normal actions, they are not intended for traces. Keep in mind that trace logging adversely affects performance and might not be feasible in a production environment. I'd suggest that you contact Support first. Please see Sophos Anti-Virus for Windows: How to enable verbose logging - as said you should work with Support to get use- and meaningful output. 

Christian