SEVEN years later and I came here looking for an answer to this exact problem: enable IPFIX = multiple/daily INFO-114 alerts; disable IPFIX = no alerts.
First off, it's incredibly disappointing that this issue still persists in 2019. Really, Sophos?!
Most importantly, tho, I was able to get this escalated thru the ranks and, after about three months, they were FINALLY able to offer a resolution: "It looks like the issue is being cause by a database view having the wrong column type. Development has provided a workaround.."
They were able to apply the "fix" without a reboot, and I haven't seen any INFO-114 alerts since (where before, we were getting around 5 per day from our busiest device).
So there's that, for whatever it's worth. At least it's a semi-resolution to this ages-old issue.
