Correctly evaluate Sophos Endpoint Windows logs and services
A Sophos Endpoint on Windows consists of several protection, update and communication components. A red Health State therefore does not automatically mean that the entire agent has failed. For reliable diagnosis, first associate the symptom with a component and then examine only its log for the relevant time window.
Most operational logs are under C:\ProgramData\Sophos. Installation logs are typically under C:\Windows\Temp, C:\Windows\SystemTemp or the %TEMP% directory of the account that started the installer. In recent Core Agent versions, some user-interface logs are stored under %LOCALAPPDATA%.
From symptom to the correct log
| Symptom | Primary log | What it shows |
|---|---|---|
| Update does not start or ends with an error | C:\ProgramData\Sophos\AutoUpdate\Logs\SophosUpdate.log | Download, package verification and update process |
| Central policy or command does not arrive | C:\ProgramData\Sophos\Management Communications System\Endpoint\Logs\McsClient.log | Connection between Endpoint and Central |
| Policy was received but not applied | McsAgent.log in the same directory | Received policies and other Central commands |
| Tamper Protection or a protected file blocks an action | C:\ProgramData\Sophos\Endpoint Defense\Logs\sed.log | Protected registry, process and file access and blocks |
| Web Control or Web Protection blocks a connection | C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\SophosNetFilter.log | Website connections and resulting actions |
| Cleanup remains open or fails | C:\ProgramData\Sophos\Clean\Logs\SophosCleanup.log | Cleanup, SafeStore checks and cleanup process |
| Protection component reports a Health error | C:\ProgramData\Sophos\Health\Logs\Health.log | Aggregated state of Sophos components |
| Live Discover query does not run | C:\ProgramData\Sophos\Live Query\Logs | Service start, query packages and on-demand queries |
| Live Response starts or ends unexpectedly | C:\ProgramData\Sophos\Live Terminal\Logs\SophosLiveTerminalService.log | Actions of the Live Terminal service |
File names can change with a Core Agent version. The current Sophos KBA and the files actually present on the affected device are therefore authoritative.
Updates and AutoUpdate
SophosUpdate.log is the most important log for the update process itself. On currently supported Windows versions, sau-service.log shows when Central or a changed update or communication policy triggered an update. SophosLaunchUpdate.log records the start of the update process.
Do not assess an update failure from only the last Error line. First check:
- which update destination was actually used,
- whether direct access, a proxy or an Update Cache was involved,
- which HTTP or TLS error occurred first,
- whether the same time is visible in the firewall or proxy log.
Invalid entries in the Windows hosts file can direct Sophos destinations to the wrong address. For reproducible errors, compare SophosUpdate.log, DNS, proxy data and a simultaneous packet capture.
The classic Sophos AutoUpdate Service no longer exists on modern Windows platforms. If it is missing on an explicitly supported legacy platform, repair the cached AutoUpdate MSI with administrator rights and then trigger About > Update Now again. Do not use this old MSI procedure on Windows 10 x64, Windows Server 2016 or newer platforms.
Central communication and policies
The Sophos MCS Client maintains the connection to Sophos Central. McsClient.log answers whether the endpoint can reach Central. McsAgent.log then shows which policies and commands were processed. A recent Last Active time in Central is a useful indication of working MCS, but it is updated only approximately once an hour at most.
For a communication error, check the broker address, DNS, routing, proxy and firewall. After correcting the issue, the Sophos MCS Client service can be restarted and Endpoint Self Help refreshed. Disable Tamper Protection only if the specific intervention requires it.
Protection, blocks and cleanup
sed.log is the central operational log for Sophos Endpoint Defense. Among other details, it contains access to protected registry keys, processes and files, and blocked actions. seds.log helps determine whether drivers and the service loaded.
For cleanup, SophosCleanup.log and the associated Scan_*.log files are relevant. They show the detected threat, action performed, SafeStore check and duration. Before restoring from SafeStore, determine whether the file is safe and why it was detected.
A single log entry is not a reason to approve an exception. Create one only after checking the file, publisher, hash, reputation and business need.
A concrete example is Splashtop Streamer 3.5.6.0: many rapidly rotating and renamed log files can fill the Sophos scan queue and increase CPU and RAM use. Prefer updating to Splashtop Streamer 3.5.8.0 or later and then restarting. Only when the update is temporarily impossible, assess the log path actually used as a narrowly scoped file or folder exclusion for the affected group. A global exclusion of the entire Splashtop directory is too broad.
Another clearly identifiable cause of sustained high SEDService.exe CPU is a Sysmon rule for file-delete events that also tries to archive .bin files under C:\ProgramData\Sophos. Sysmon and Endpoint Defense then contend for compressed event-journal files, and sed.log repeatedly refers to the Sysmon archive path. Exclude the Sophos ProgramData structure specifically from this FileDelete archiving in the active Sysmon configuration, not from Sophos scanning. After reloading the Sysmon configuration, SEDService.exe should process the open journal files within a few minutes and the load should fall.
Assess services correctly
Sophos describes the service consolidation in the modern 2025.2.1 line as a performance optimisation: fewer background services, threads and resources with unchanged protection and Central communication. Comparing against an old service list therefore causes incorrect repair attempts. Platform, Core Agent version and current component status in Self Help are authoritative.
A rare counterexample occurs after a failed Windows 11 feature update with rollback. If the rollback coincides with a DecisionCache update, registry and file-system versions can diverge. The endpoint turns red, System Protection does not start and C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log reports a missing rules version.
Do not wait up to 96 hours for possible automatic repair while System Protection is absent. Temporarily assign the device an Update Management policy with a supported FTS or LTS package. The resulting reinstallation realigns the references. Remove the device from the repair policy only after green health, a running component and a current SSP log. Align the registry manually only with a Tamper Protection override, a backup and the exactly matching rules directory.
Not every current Sophos component appears as a conventional Windows service in services.msc. On supported platforms from Core Agent 2025.2, Sophos removed Sophos Live Query, Sophos Health Service and Sophos System Protection Service, among others, from Windows Service Control Manager and integrated their functions into dedicated Core or Sophos service modules. A missing Windows SCM entry therefore does not prove an installation error.
The following processes are particularly relevant for basic mapping:
| Service or component | Process | Purpose |
|---|---|---|
| Sophos Endpoint Defense Service | SEDService.exe | Core Endpoint Defense functions and coordination between modules |
| Sophos File Scanner Service | SophosFS.exe | Starts worker processes for file scans |
| Sophos MCS Client | mcsclient.exe | Connection to Sophos Central |
| Sophos MCS Agent | mcsagent.exe | Processes management communication |
| Sophos Network Threat Protection | SntpService.exe | Network threats, web filtering, isolation and other network functions |
| Sophos System Protection Service | SSPService.exe | Collects and correlates protection information locally and with cloud queries |
| HitmanPro.Alert service | hmpalert.exe | Exploit mitigation and behaviour-based protection |
| Sophos Device Encryption Service | Sophos.Encryption.BitLockerService.exe | Manages BitLocker through Sophos Device Encryption |
The components that must be present depend on the platform, Agent Mode and licence. An XDR Sensor, for example, installs telemetry components but not full Sophos malware protection. Determine the expected state in Central first, then compare it with services and processes.
Network and web protection
SophosNetFilter.log contains website connections and actions from Web Control and real-time internet scanning. SophosIPS.log shows the configuration and detection content of network threat protection. SntpService.log includes information about isolation and other network functions.
For a blocked website, compare the time, URL, process and effective policy. The log alone does not always reveal whether Endpoint Web Control, DNS Protection or an upstream firewall blocked first. Check these control points separately.
User interface and Self Help
In current Core Agent versions, SophosUI.Net.log and SophosUITray.log are located under:
%LOCALAPPDATA%\Sophos\Sophos UI\Logs
They record actions in the local interface and at the taskbar icon respectively. From Core Agent 2026.1, Self Help logs can also be stored per user under %LOCALAPPDATA%\Sophos\Endpoint Self Help\Logs. Depending on the component, the machine-wide directory under C:\ProgramData\Sophos\Endpoint Self Help\Logs remains relevant as well.
Evaluate a log properly
Before opening the log, define a narrow error window including the time zone. Then read forwards from the first relevant error. Later consequential errors such as service unavailable, timeout or component unhealthy are often only symptoms.
A reliable note includes:
- the visible symptom and a reproducible test,
- the log name, timestamp and first relevant message,
- the Endpoint, proxy, cache or relay path involved,
- a comparison with a working device,
- the change tested and its measurable result.
Do not permanently increase logging levels as a precaution. Detailed MCS logging can contain sensitive communication data and consume additional storage. Enable it only for a defined time window according to current Sophos instructions and then reset it.
For MCS communication analysis, Sophos Support may also request a diagnostic message trail. On Windows 10 x64 or Windows Server 2016 and later, it has been enabled by default since Core Agent 2023.2; old XML configuration steps apply only to legacy platforms. On macOS, enable SMEMcsEnableMsgTrails for a limited period and restart SophosConfigD. The generated .xml, .umc, .chunk or .policy files contain policy and communication data. Transfer them securely and disable or clean up the trail after capture. Permanently enabled trails can fill the disk.
Preserve logs for Support
Individual logs help with local diagnosis. For escalation, also create an SDU collection from the same error period. The package can contain hostnames, users, paths, IP addresses and configuration data and must be transferred securely.
Diagnose Sophos Endpoint with Self Help and SDU explains the complete collection. Installation errors are covered separately in Systematically troubleshoot Sophos Endpoint installation on Windows.
Frequently asked questions
Which log shows whether a Central policy arrived?
McsClient.log shows the connection to Central. McsAgent.log shows the application of policies and other Central commands. For diagnosis, check both together with the effective policy in Central.