Diagnose Sophos Endpoint with Self Help and SDU

Random reinstallation does not resolve an Endpoint problem. First determine whether the issue affects protection components, Central communication, updates, a policy, the operating system or the network. Endpoint Self Help provides local status information and initial causes. Sophos Diagnostic Utility, or SDU, then collects the technical logs.

The Endpoint onboarding path covers the complete journey from planning through operational handover.

Quick workflow for a reliable diagnosis

1. Record the symptom, impact, error time with time zone, and a reproducible test.
2. Open Endpoint Self Help and check the affected area and Network Test.
3. Enable only the additional diagnostics relevant to the fault and reproduce it within the agreed time window.
4. Revert or stop debug logging and packet capture afterwards, then collect an SDU covering the same time window.
5. Transfer the support package securely and associate it with the case, your own log analysis, and the displayed SDU filename.

This keeps status checks, reproduction, and evidence collection aligned in time. Do not begin repairs or broad exclusions until the observation has been preserved.

Before collecting logs

Document the visible symptoms before any diagnosis:

• affected computer, operating system and time,
• local error message or screenshot,
• Central Health, Last Active, Agent Mode and effective policies,
• most recent installation, update or policy change,
• reproducible test and expected behaviour.

This information is often more useful than a very large log archive without a time reference.

Open Endpoint Self Help

ESH supports Sophos Fusion (formerly Sophos Central) Windows Endpoint and Windows Server. Open it in the local Sophos Endpoint interface via About > Open Endpoint Self Help Tool, or directly from C:\Program Files\Sophos\Endpoint Self Help. The pages shown depend on the licence, installed components and agent/platform generation; legacy Windows platforms expose less status and functionality than modern platforms.

On modern platforms ESH closes after two hours without interaction (Core Agent 2024.2 and later) and warns five minutes beforehand. From Core Agent 2024.3 it also checks Known Issues at launch. Current modern agents separate System, Services and Update status; older agent generations can group or omit those views. Record the agent version with every screenshot rather than treating a missing page as a fault.

Self Help is useful for questions such as:

• Is the expected component running?
• Is a service stopped or faulty?
• Can the agent reach Central and the update infrastructure?
• Is there a known local configuration or permission error?

Document a red check with its name, status, detail text and time. Before repairing it, check whether a central policy or network block would recreate the cause.

If SophosDiag.exe crashes as soon as it opens and the Windows Application Event Log identifies a damaged user-specific user.config, remove only the file named in the error from the affected user profile. Do not automate deletion of the version-dependent parent directory as a fixed path. Then reopen Self Help. If the error persists, collect an SDU or repair the installed component.

Use Self Help pages selectively

The individual pages answer different questions. Do not read them as a general traffic light:

A policy update can take up to five minutes. If Override Sophos Central Policy for up to 4 hours is active locally, new Central policies are cached and applied only after the override ends. An old policy time is then not proof of a communication failure.

Under Components, compare the installed, downloaded and expected module versions. Check Not installed, differing download and installation states or multiple versions first against the update state, a pending restart and competing security software. Do not delete the local repository as a precaution. Under System, a persistent Pending Restart may originate from Windows Update. After hardware or security-software changes, rescan the software state with the Endpoint CLI before starting a repair.

Central actions normally arrive within a few seconds or minutes. Last Active, by contrast, is updated no more than approximately hourly. A user policy can take longer to change because the Central user, locally signed-in account and interactive session detected by the MCS Client must match first.

Interpret Network Test correctly

Network Test checks the Updating, Management Communication and Sophos Extensible List (SXL) channels. For each destination, the tool first attempts HTTPS, then ICMP and DNS resolution depending on the result. A successful HTTPS connection is decisive for operation. A ping or nslookup alone therefore does not prove working Central communication.

Run it first when Update or Communication is unhealthy, a device appears offline in Live Discover or Live Response, or real-time scanning, Web Control or SXL-backed functionality fails. The result identifies the failing stage; it does not diagnose the firewall, proxy or DNS cause by itself.

For an Update Cache or Message Relay, Self Help checks only DNS resolution of the assigned server. A green DNS test confirms neither the service state, port nor forwarding. Check the actual cache or Relay function separately.

Two limitations are particularly important:

• After changing a cache or Relay assignment, close and reopen Endpoint Self Help; otherwise Network Test may continue to use the old destination.
• Network Test does not support authenticated proxies and can produce misleading results.
• On Windows 7/8/8.1 and Server 2008 R2/2012, the sdds3.sophosupd.net HTTPS test can fail because the operating system lacks the offered cipher suites.

SXL tests require administrative UAC elevation. If the device uses a Message Relay, Self Help does not run the SXL test directly because this traffic passes through the Relay.

If communication remains faulty, compare the broker addresses shown in Self Help with the local MCS configuration. Also check routing, the Windows hosts file, proxy and firewall log. After a correction, restart the Sophos MCS Client and refresh Self Help. Browser access to Central is not a substitute for this check.

Update errors without prematurely deleting the cache

A failed update within the Sophos grace period may be temporary. First check Update Now, the network, proxy, update source and time of the last successful update. Only if these checks show no cause should the local AutoUpdate cache be reset using the Sophos-documented method.

For a reproducible error, correlate SophosUpdate.log with a simultaneous packet capture and firewall or proxy logs. The decisive details are the DNS response, update server actually contacted, direct or proxied path and the first HTTP or TLS error. The most important Windows log paths are listed in Correctly evaluate Sophos Endpoint Windows logs and services.

This intervention requires Tamper Protection to be disabled and administrator rights, and it generates a Pending Restart alert. Preserve or rename the cache and repository directories; do not delete them without checking. Afterwards, a complete update must succeed and Self Help must show a healthy state again after Refresh.

Performance Analysis

From Core Agent 2024.3, Endpoint Self Help can load scanner summaries on Windows 10 x64 or later and Windows Server 2016 or later. Inputs are summaries created by a Product Analysis workflow or by enabling SFS > Scan Summaries in Product Logging. They may come from this or another ESH-equipped device. The CSV files are stored by default under:

C:\ProgramData\Sophos\Sophos File Scanner\Logs\summary.<TIMESTAMP>.csv

They can be analysed in Endpoint Self Help on another device. The file shows which processes and paths generated scanning load during the recorded period. It does not justify a blanket exclusion. First examine the application, access pattern and narrowest technically appropriate exclusion.

When evaluating the data, compare folders with long cumulative scan times first, then frequently scanned paths and finally large data volumes. A frequently scanned path is not necessarily the path with the greatest total duration. If Self Help warns that an exclusion is too broad, use it only briefly to confirm the cause. Narrow any permanent solution to the actual subfolder or process creating the load.

Product Analysis goes further by guiding the disabling and re-enabling of protection features to isolate the component involved. It requires administrator rights and, when Tamper Protection is active, its password. Run it only on a controlled test device or in a maintenance window. Record protection and update state first, save the result, then restore every feature and update setting. The tool provides a hypothesis, not automatic approval for an exclusion.

Use File Info instead of guesswork

Under Tools > File Info, a Windows PE file can be assessed locally. Self Help shows SHA-256, size, Application Control category, product name, and resulting policy decision. Local Reputation includes Sophos data and customer Allowed Applications or Blocked Items, so it can differ from and override the live Global Reputation for the local decision.

Deep Learning requires an appropriate Intercept X licence. A green result does not prove that already detected malware is harmless; detected malware or PUA files normally cannot be dragged into this page. For a misclassification, preserve hash, signature, local and global lookup type, and the concrete policy decision, then use the documented sample-submission process.

File Info is richest for Windows PE files; other file types return limited data. If ESH was started with Run as administrator, Windows can block drag-and-drop from a lower-privilege process. Use browse for a file instead. Reputation and policy output is decision support, not an integrity guarantee: verify a file through an approved sample-analysis process when trust matters.

Investigate policy, service, and operations status

If the Policy page shows stale timestamps, distinguish receipt from local processing. Check McsClient.log for connection and backoff entries and McsAgent.log for policy, namespace, and status errors. In the MCS cache, Active.policy and Latest.policy show whether a new policy arrived but did not become active locally. Restart services only after preserving the observation, then confirm the successful transition in the log.

Not every blue or empty icon on the Operations page is an error. Distinguish a disabled Data Lake function, an intentionally excluded device, or a reached daily upload limit from a genuinely faulty Live Query service. For poor Data Lake status, check SophosLiveQueryService.log, SophosOsquery.log, and service state first.

The Heartbeat section shows readiness, certificate state, and connection to a Sophos Firewall. configured, no connection currently available alone does not prove an endpoint fault, and Heartbeat status does not affect general Device Health. When a connection is expected, correlate endpoint and firewall logs by time and Device ID. Perform Registry or certificate repairs from Advanced Self Help only with export or backup, Tamper Protection disabled, and a documented rollback path.

Start SDU from the interface

Open Launch SDU from Endpoint Self Help, accept the EULA, and select Start. SDU collects system information and logs for installed Sophos products. When it finishes, View log shows what was collected, Open folder opens sdu.log and the archives, and Submit offers upload or manual case submission. On Windows, running sducli.exe without collection switches saves under C:\WINDOWS\Temp\sdu-YYYYMMDD_xxxxxx_xxxxxx.

For Upload to Sophos, permit sdu-feedback.sophos.com over TCP 443. The returned upload URL is intentionally not browsable; copy it into the support case. If it was overwritten on screen or clipboard, recover it from the end of sdu.log.

The archive can contain hostnames, usernames, paths, IP addresses, process lists, configurations and Events. It must not be stored in public tickets, unprotected file shares or chat histories.

An online Windows, macOS or Linux device can also be diagnosed from Central. Open My Environment > Computers & Servers, select the device, then on Summary choose More actions > Diagnose > Run. The SDU panel reports Status, Last Run, and File Name; record that filename for Support. The archive is uploaded by HTTPS on port 443 using the normal allowed Sophos domain path. The initiating administrator and action appear under Reports > General Logs > Audit Logs.

If the device is offline, Central retains the request for no more than 14 days. It then discards the request and it must be started again. The command begins with the next Central communication, so clarify timing, data-protection approval and expected device connectivity beforehand.

Product Logging and Packet Capture

Product Logging raises the log level for selected Endpoint components and requires UAC elevation. A parent setting applies to all children; an asterisk at the parent means only a child differs. Save applies pending levels, while Revert… before saving discards pending edits. To undo an applied level, select Default for each changed parent or child and click Save. Closing ESH does not reset logging: Revert to Default resets and closes, while Just Close leaves it active. Preserve the logs with start/end time and test steps; persistent debug logging can expose sensitive content and consume substantial storage.

Self Help packet capture uses Windows pktmon, requires UAC elevation, and is absent before Windows 10 1809 and on Windows Server 2016 or earlier. The default limit is 512 MB and can be set from 1 to 9999 MB; Windows 10 builds before 2004 always use 512 MB. Each run creates both capture-<date><time>.etl and capture-<date><time>.pcapng under C:\ProgramData\Sophos\Endpoint Self Help\PacketCapture; submit both. Closing ESH stops capture. Files are not purged automatically, so remove them manually after the approved retention period.

If Self Help cannot elevate logging, packet capture, or SDU, check Windows UAC settings first. Fully disabled UAC or suppressed elevation prompts can block the function. Restoring Microsoft defaults is cleaner than permanently running Sophos tools through the built-in Administrator account.

Run SDU from the Windows command line

The Windows version is normally located at:

C:\Program Files\Sophos\Sophos Diagnostic Utility\sducli.exe

The following command in an administrative prompt displays the built-in help:

& "C:\Program Files\Sophos\Sophos Diagnostic Utility\sducli.exe" -help

Important parameters include:

The -help output from the locally installed version is authoritative for the available agent version. Automated collections have a storage limit, secure destination and deletion deadline.

Run SDU from the macOS command line

On a Mac, start SDU from the application bundle:

/Library/Sophos\ Anti-Virus/Tools/Sophos\ Diagnostic\ Utility.app/Contents/MacOS/Sophos\ Diagnostic\ Utility --help

--help only displays available commands; it does not collect diagnostics. The runnable collection command is:

/Library/Sophos\ Anti-Virus/Tools/Sophos\ Diagnostic\ Utility.app/Contents/MacOS/Sophos\ Diagnostic\ Utility --cli

Use --output_path="<path>" to set its output folder (otherwise the current directory). These options apply to macOS agent 2026.1 and later. The process requires the permissions needed for the data being collected. Check missing Full Disk Access or System Extension approvals separately through macOS permission diagnostics.

Run SDU from the Linux command line

On a device protected by Sophos Protection for Linux, the installed diagnostic utility runs as follows:

/opt/sophos-spl/bin/sophos_diagnose

It creates a tar.gz archive in the current working directory. The utility collects logs from the SPL agent, all plugins and the audit log. To use a controlled output folder, create a private directory and pass that directory as the first positional argument:

mkdir -p "$HOME/sophos-sdu"
chmod 700 "$HOME/sophos-sdu"
/opt/sophos-spl/bin/sophos_diagnose "$HOME/sophos-sdu"

The final argument is a directory, not an archive filename; the resulting tar.gz is created inside it. This preserves the vendor syntax while avoiding a shared temporary folder.

Understand forensic mode

SDU can create special forensic logs. This mode is intended for Sophos Incident Response or a targeted forensic investigation. It does not replace a complete enterprise forensic process and should not remain enabled without a defined mandate.

Additional rules apply to a possible compromise:

• do not restart or clean up the device hastily,
• document the time source and time zone,
• write evidence only to a controlled destination,
• record the hash, transfer and access to the archive,
• involve those responsible for Incident Response.

Output configuration and software status by CLI

The local Endpoint CLI can output policy and software states. Output configuration shows which settings reached the device. Software Monitor reports the state of installed components and can refresh their status.

These outputs help with three common discrepancies:

1. Central shows a policy as assigned, but the setting is missing locally.
2. Agent Mode is correct, but a component is not installed or healthy.
3. An update was announced, but Software Monitor remains in an error state.

Check the locally available help before use because commands and parameters can depend on the installed agent version.

Analyse logs selectively

Do not read every log in full. Start with a narrow time range and look for the first error, not merely subsequent errors. Particularly useful sources include:

• installer and update logs for rollout problems,
• MCS or management communication for missing Central contact,
• Health and component logs for a red state,
• Web, DLP, Application or Peripheral Events for policy problems,
• operating-system Event Logs around service starts, drivers and certificates.

One error is not necessarily the cause. Timing, component and reproducible behaviour are decisive.

Prepare a support package

A good support package contains:

1. a brief problem description and impact,
2. the exact time with time zone,
3. affected and unaffected comparison devices,
4. steps to reproduce,
5. relevant Central screenshots without secrets,
6. the SDU archive and installer logs where applicable,
7. measures already tested and their results.

Never attach Tamper Protection passwords, API Secrets, proxy passwords or installer tokens in plain text.

Meet the Minimum Escalation Requirements

Sophos divides the Windows Endpoint requirements for support escalations by error class. An SDU without your own analysis does not satisfy these Minimum Escalation Requirements, or MER.

For every case, first record the platform and product version, affected component, scope, frequency, reproducibility, changes before the issue and exact error messages. Logs must be complete, include the time of the error and align in time for client-server problems.

Then add scenario-specific data:

For a performance case, first distinguish whether SophosFileScanner.exe, SEDService.exe, SSPService.exe, another Sophos process or general system load is abnormal. Globally disabled protection without a simultaneous measurement and precise component attribution does not provide a reliable cause.

A support case must include not only the collected files, but also the outcome of your own analysis: Which log shows the first relevant error, at what time, and which hypothesis did it confirm or reject?

Also check Account Preferences > Evaluation Modes for Aggressive threat detection. This Sophos Support and SophosLabs diagnostic option significantly increases system load and is not a production security baseline. If enabled, document its purpose and disable it again after the intended measurement. If the problem remains, continue as a separate performance case with a new time window.

For exploit, ransomware or HitmanPro.Alert cases, also check whether Sophos offers an Endpoint Maintenance Release containing a relevant bug fix. Create a crash dump or complete memory dump after reproducing the issue and before the SDU so that all artefacts cover the same time window. Do not rename protection DLLs or drivers without a current Sophos runbook.

Frequently asked questions