Where can I access NTP logs?

I have several systems that sntpservice.exe is utilizing a too much memory, then crashing and rebooting workstations. In doing some digging I saw some people reported resolving their issue by looking at the NTP logs, but they did not indicate how they accessed those.


Can anyone provide me detailed instructions on how to obtain the NTP logs on windows systems?



  • Hello ReconLuke,

    the log is in %ProgramData%\Sophos\Sophos Network Threat Protection\Logs\. It likely doesn't directly indicate the memory leak or what's causing it. There might be some events apart from the usual Driver loaded/unloaded in the Windows Event Log (System) with Event Source Sophos Network Threat Protection. Likely there won't be much information though unless you turn on more verbose logging.