I am getting this error code: e03d0056 using Sophos Enterprise Console version 5.4.0 on a few of our Sophos managed computers. I ask this because when I click on the corresponding link under the Computer Details screen, I get this: Your search - sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase - did not match any documents. No pages were found containing "sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase". Under the Scanning errors column, it shows, "; The on-access driver failed to determine the name for a file. [0xe03d0056]". What I am hoping for is information that provides: where to look, what it is, what could be causing it, the importance, or a possible solution.
  • Hello TedMoyers,

    please see the Scanning error message thread. 


  • In reply to QC:


    I have looked at the other post and don't see the correlation. I'm having this pop up on around 60 machines and I'm just trying to tidy up our console. Can you elaborate on how we resolve this?



  • In reply to logan williams:

    Same here. How do I resolve this?

  • In reply to Teri Grinnell:

    The on-access driver failed to determine the name for a file. [e03d0056] seems of little use.

    I would suggest to suppress it: e03d0056 as a 32-bit unsigned dec is: -532873130.

    There is a table in the 'core' database called: "ErrorAlertFilters"; you could try using this to filter it out in the future, for example the command (admin prompt):

    sqlcmd -E -S .\sophos -d SOPHOS550 -Q "INSERT INTO ErrorAlertFilters (Source, Number) VALUES ('SAV', '-532873130') "

    I have assumed a default local Sophos instance (.\sophos)  is being used and SEC 5.5, hence the SOPHOS550 database name.  
    For more details on the database name see: https://community.sophos.com/kb/en-us/17323
    For locating the instance of SQL in use by SEC see: https://community.sophos.com/kb/en-us/113030 

    This will prevent the "SAV" message being displayed in SEC in the future if you acknowledge the current ones.

    Hopefully that helps.



  • In reply to Wallsy:


    I further investigated this often happening alerts on Sophos Enterprise Console for Anti Virus.

    It seems to me this can be reproduced when a user tries to click on a windows .lnk file that refers to an unavailable network drive location (e.g. network drive no longer mapped).

    I then noticed, right clicking this "dead link" .lnk file and choosing "Scan with Sophos Anti Virus" ends in an "Unknown Error".

    This should be fixed by sophos after investigation if its really a bug.

    Thanks and kind regards

  • In reply to Polygon-tre:

    I will give this a go and see if I can replicate you are seeing, Sophos have not been the best with this one.


  • In reply to Wallsy:

    This error is not random for one of our laptops running Windows 10 and the preview version of endpoint.

    Open SEC acknowledge this error and any others(e03d000f and a05800c) reboot the laptop and before I can login error e03d0056 is back followed by e03d00f and then a05800c.


    I am really starting to think it is normal for sophos end point to be polluted with random errors.



  • In reply to Navar Holmes:

    Hello Navar Holmes,

    these errors aren't normal.
    Apparently they can be "reliably reproduced". I'd open a ticket with Support as it should be possible to get closer to the actual cause but this requires some specific tracing.


  • In reply to QC:

    I have opened a ticket with support, and they are telling me to supress it, after many months of more logs and trying different things, I'm not sure that supressing the error, is the smartest thing to do. but I'm spending so much time on this, it needs to end, I'm being to told that the error cant be reproduced and it is transient, so supressing it is the way to go.