sophos anti virus Event ids


I'm setting up Tivoli software to monitor sophos anti virus,  does anyone know what windows event id's are genterated by sophos

when a virus is detected or sophos stops running?

  • Hi,

    I would suggest using Evntwin.exe to get the event IDs and their text. This should be installed if you add the feature "Simple Network Management Protocol (SNMP).

    Once installed run: Evntwin.exe

    Choose "Custom" as the "Configuration type" Then click "Edit".

    You can then choose the "Event sources": "Application" - "Sophos Anti-Virus"

    As a quick method, if you detect Eicar on your machine you can then check the event logs but the above method will give you access to all the messages Sophos Anti-Virus will log from the source "Sophos Anti-Virus" to the Application event log.

    I hope this helps.