This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos On Access Scan Logs?

Is there any way to find out what SophosScanD is scanning? I am trying to see why running a dev build takes longer than expected despite having an exclusion in place for the folder the build is being executed on. So far the log files I have found for Sophos only show server communication status and update instances.

This thread was automatically locked due to age.

+1 Haridoss Sreenivasan over 6 years ago

Hi SadiAhmed

You would need to enable the Verbose logging for the detailed log report. Please refer to SAV for OS X - Enabling Advanced Logging and Storage on Sophos Cloud managed endpoints. Once enabling the Verbose log, Recreate the issue and save the log, also ensure to disable the Verbose logging after the log is saved. Let me know if this helps solve your question.

Haridoss S

Haridoss Sreenivasan
Technical Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago

Hello SadiAhmed,

there's no regular log which would show the activity of the On-Access scanner. If there is an option to enable activity- or debug-logging it's not documented (for a paid-licensed version Support might tell you).

having an exclusion in place
if it's not in the right place it won't help. The build might touch a number of files in other places, create temp files, and so on. fs_usage might give a hint where scanning takes place though it doesn't reflect SophosScanD's actual activity.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 SadiAhmed over 6 years ago in reply to Haridoss Sreenivasan

Is there anything similar to run for Mac OS?
Cancel
Vote Up 0 Vote Down

Cancel
0 SadiAhmed over 6 years ago in reply to QC

Thanks Christian,

I will try to run fs_usage to see what is running, but ideally knowing what SophosScanD was looking at would give some more insight on if I should have more exclusions in place. I will try to see if this command helps in determining that.
Cancel
Vote Up 0 Vote Down

Cancel
0 Haridoss Sreenivasan over 6 years ago in reply to SadiAhmed

Hi SadiAhmed

The article mentioned above helps you enable the debugging via terminal in the Mac OS.

Haridoss S

Haridoss Sreenivasan
Technical Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 SadiAhmed over 6 years ago in reply to Haridoss Sreenivasan

Oh sorry about that, I had opened up a link from a different post and thought it was in reference to this.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Bob Koskovich over 5 years ago in reply to Haridoss Sreenivasan

The referenced kb 123239 seems to be gone, and I have been searching in vain for an equivalent/replacement. Does anyone have a reference to a new kb on this subject?

- Bob
Cancel
Vote Up 0 Vote Down

Cancel