Sophos health service high cpu. I can the remove Sophos Endpoint to get the machine working again. 400-9 on Mar 30th No high CPU issues prior to update Today’s high CPU is ongoing since midnight (literally midnight 00:00) Over the past few days there were the occasional high CPU events typically in the AM Each time there is no download traffic going on Abnormal high CPU Usage Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Contains functionality to query CPU information (cpuid) Contains functionality to query locales information (e. Updated to 9. system language) Contains functionality to read the PEB Overview Performance-related issues are being experienced on Windows devices. At its core, Sophos protects endpoints—servers, desktops, laptops, mobile devices—from a variety of cyber threats. Sophos High CPU Usage Issue Since late last fall, I have ran into a few different random Macs at my organization that have become unusably slow after installing Sophos Endpoint. Sep 2, 2022 · What applications running on the system, and are you observing any specific application being launch when you observed the high CPU utilization? Many aspects may cause a high resource consumption on the system with security software installed, for example, incorrect exclusion, application bugs, and malware. g. Overview Performance-related issues are being experienced on Windows devices. Thus requiring Sophos more CPU cycles to work through the backlog. the nature of them, Feel free to link that file. These issues may involve high/persistent CPU usage, slow application performance, and general device slowdown. Product and Environment Sophos Endpoint Sophos Server Windows SURF Detections Detected Log Lines Log Lines Explained What to do What if I still have an issue? Detected Log Lines HKLM\SYSTEM\CurrentControlSet CPU usage varies from 90% to 50 % under the following circumstances: When I restart the system and log n to an account; When I start up from up a shutdown;' when I change user accounts (i. db is continuously being updated with its size growing every few secs. May 15, 2025 · Note You can use the Sophos Diagnostic Utility (SDU) to gain additional insight into events when troubleshooting. Overview This article is for use with the Sophos Endpoint Self Help (ESH) tool for Sophos Central Windows devices. Any one had similar problem? Jan 21, 2025 · Understanding Sophos Endpoint Defense Software Before delving into the specifics of high CPU usage, it’s crucial to grasp the fundamentals of what Sophos Endpoint Defense software does. Not seeing this at all on the work unit. Searching for troubleshooting I found out that the “Endpoint Agent” client has not updated in the last month and the button for manually update doesn’t work (the latest . For the SDU to be able to collect the system logs, we recommend you configure your Linux devices to preserve them after a restart. Start it up again and leave it while the issue occurs, leave it for say 5 mins. e. The CPU usage is caused by the Sophos scan process. Jun 24, 2019 · HIGH CPU USAGE due to Sophos Health Service| Renamed the DB File , All Servvices are OK, No Data being copied to external Drives C$\ProgramData\Sophos\Health\Event Store\Database\events. Some platforms have this configured by default. db The EVents. When you run it, the SDU collects all SPL logs, system information, and system logs. Sophos Central Endpoint and Server: Constant high CPU usage from SEDService. This is linked in the ESH tool and provides further information on the Performance Analysis page. Product and Environment Sophos Endpoint Sophos Server Windows SURF Detections Detected Log Lines Log Lines Explained What to do What if I still have an issue? Detected Log Lines HKLM\SYSTEM\CurrentControlSet Apr 3, 2022 · If I manually stop the services: Sophos File Scanner, Health, MCS Agent, MCS Client, Network Threat Protection and then EndTask the System Protection Service this reduces the memory usage and allows me to connect remotely. pgdyqj ltu muesr lwtgfwl ivmmvk chdxd yueqwg hhhtf wdg akiw