Possible Memory Problem after Windows 10 1903 Update

 

 

Currently have Sophos Central with Sophos Endpoint running on several machines here, i was the first to update to the latest Windows 10 1903 Update and noticed after the machine sitting idle for a while that the above service is consuming a lot of RAM.

 

Any solutions to this?

  • That’s certainly not right. I’ve been using 1903 for a while without issue so i think you’d be best to create a ticket with Support to investigate.  If the issue is going on now, it might be worth getting a Process Monitor capture including the System process for maybe 1 minute just to get a feel for system activity and an Sophos Diagnostic log.

    Jak

  • In reply to jak:

    ah, where does one submit a ticket? all help links brought me to here haha!

  • In reply to Gareth Johnstone:

    Hello Gareth Johnstone,

    I'm not using Central so I can just refer to Get additional help in the Central Admin Help but not verify that the information is correct.
    Or you could use the Open a Support Case page.

    Christian

  • In reply to QC:

    Thanks,

    I have contacted Sophos support - will update here with their findings!

  • I'm exactly with the same problem.

  • In reply to Charles Toniolo:

    I have to reboot daily because of this, commit size for SSPService.exe is going up by over 1MB a second. Currently stands at 35,555,724K

     

    Time for another reboot.

     

  • In reply to Tim Kemp:

    I've currently got it disabled and relying on another antivirus for the time being!

     

    My machine is simply unusable after a couple hours with sophos running

  • In reply to Gareth Johnstone:

    I wonder if it's related to the EDR component?

    If you set:
    edr_enabled

    under:
    KEY_LOCAL_MACHINE\SOFTWARE\Sophos\EndpointDefense\PolicyConfiguration

    to 0.

    Does the problem stop?

    This setting may get reverted if a policy comes down.

    Regards,

    Jak

  • Adding a "Me too!" from our company, as we start testing 1903.

    Fellow IT person was copying a large file to a (Sophos-managed) encrypted drive.

    Memory maxed out.

    The machine locked up and rebooted shortly after, with hmpalert.sys as the KMODE EXCEPTION NOT HANDLED bsod.

    Winver: 10.0.18362.113

    Sophos components:

    HitmanPro.Alert 3 (managed by Sophos) 3.7.12.466
    Sophos Clean 3.8.6.1
    Sophos Endpoint Agent 2.3.0
    Sophos Endpoint Defense 2.1.2.0
    Sophos ML Engine 1.1.203
    Sophos Standalone Engine 1.2.24
    Sophos Endpoint Firewall 1.1.0.0
    Sophos Network Threat Protection 1.8.1555.0
    Sophos Exploit Prevention 3.7.12.466
    Sophos Endpoint Self Help 2.1.14
    Sophos File Scanner 1.5.15.0
    Sophos Endpoint 1.7.134
    Sophos Diagnostic Utility 1.21.0.0
    Sophos Data Protection Agent 1.4.103.0
    Sophos Anti-Virus 10.8.3.441
    Sophos AutoUpdate XG 6.0.457.0
    Sophos Health 2.1.0.33

  • Don't have anything useful to add but 1903 seems to allow for runaway memory consumption by System Protection Service and hitmanpro / other process crashes.

     

    Agent Version         10.8.3 VE3.74.1

    Core Agent             2.3.0

    Sophos Intercept X  2.0.14

    Endpoint Protection 10.8.3.441

     

    Any solutions / suggestions gratefully received.

  • Sadly still no where with this  - still communicating with Sophos on this one.

  • In reply to Gareth Johnstone:

    Hi  

    Can you please PM me the support case number so that I can look into it for you? 

  • Hi everyone, 

    I will need to contact my team regarding this to check if we have seen many reports similar to this issue.

  • Same issue for me. I'm testing Win 10 1903 on my machine and SSPService.exe uses a load of RAM.

  • Same issue here as well with 1903 Enterprise. It will continue to consume RAM to the point of crashing the machine. Only ways around are to reboot just about every other day (64GB of RAM), or if caught before it starts crashing other services, then restarting the Sophos services forcibly seems to work.