Monitor and maintain Sophos XDR Data Collectors

Monitor Sophos XDR Data Collectors under Security Operations > Integrations > Data Collectors. Reliable operational validation covers three levels: the collector is reachable, expected sources are sending, and events arrive correctly in the backend. Online status alone answers only part of that check.

This runbook covers collectors already deployed. The migration runbook explains replacement of legacy SVA log collectors and on-premises deployment. Deploy new AWS, Azure or GCP instances using the cloud guide. Do not install additional third-party applications on these appliances.

Check status and sources together

In table or card view, identify the correct collector by name, platform and tenant. Status values mean:

• Online: The collector has reported in; its applications are deployed and healthy.
• Warning: Some applications have not reported recently or were not deployed correctly.
• Offline: A previously deployed collector has not reported recently.
• Provisioning: The collector has not yet been deployed.

Last Log Seen shows receipt of a log within the last hour. N/A means nothing has been reported during that hour. This may be expected for an intentionally quiet source; for an active firewall, investigate the cause. Another sending host can make the collector look active even when an important individual source is missing.

Open the collector and compare healthy, warning and no-data source counts under Summary > Current Data Sources. Clicking a metric opens the corresponding filtered source list. Under Health, the ingress graph and syslog source table show who is actually sending to the collector. The default period is one hour and can be extended to 30 days. Compare a source’s previous activity with the current outage.

Total Events describes events collected by the collector in the last 24 hours. Data Usage, by contrast, shows the tenant’s usage for the current month and must not be attributed solely to this collector. For an external inventory, use Actions > Export All as CSV. Check export status and download on Data Exports.

To validate a source, correlate an expected authorized event with its source system and time, then check it through the intended XDR search path. Ingress activity at the collector proves neither correct normalization nor detection. The custom parser runbook covers format and parser questions.

Interpret backlog and throughput

On Performance, first select the same period as for the source check. Backlog Age is the age of the oldest file waiting to be sent to the backend; Backlog Count is the number of queued files. Sophos batches and compresses events before transmission; these values do not directly indicate the number of lost logs.

Occasional brief spikes, typically below a minute under high load, can occur. The trend matters more: if age and count rise continuously or during business hours and only fall overnight, processing or transmission is not keeping up with the current load. Investigate outbound bandwidth, QoS, proxy and collector load together. Rebooting does not explain or resolve a sustained capacity shortfall.

Ingress / Egress shows received and transmitted bytes on the primary network interface. More incoming than outgoing bytes are not automatically a problem because of compression. If the backlog also grows while egress reaches a plateau, check the uplink and its limits. Record MIN, MAX, AVG and LAST with the period and affected sources, rather than keeping only an isolated screenshot.

The collector has a 200 GB spool for temporarily delayed or interrupted forwarding. This is neither an unlimited buffer nor a substitute for SIEM retention. The vendor’s figure of up to 200,000 EPS also applies only to appropriately configured systems and is not a guarantee for every VM or connection. Identify the actual bottleneck before changing resources to address a continuously increasing backlog.

Set maintenance windows in UTC

Normal software updates are automatic, typically every 24 hours when the collector is connected and healthy. Service maintenance covers larger changes such as OS or kernel upgrades and may require a restart. A weekly preferred window does not mean this maintenance takes place every week.

Open Maintenance on the details page:

1. Under Maintenance Window, select the weekday and start time in UTC. Separately check the corresponding local time, including daylight saving.
2. Select a duration of two to six hours. Choose a low-load period when operational staff can respond.
3. Save with Submit Update and read back the displayed window.
4. Separately check already scheduled maintenance under Logs > Upcoming. Changing the preferred window later does not move it.

Upcoming maintenance can be deferred once to the following week using its checkbox and Defer Maintenance. Statuses such as Pending, Download Ready, Upgrade Ready, Upgrade Running and Upgrade Running Rebooting show progress. Under History, check Complete or Failed with times and outcome. Maintenance does not start if the collector is unhealthy or unreachable at the scheduled time.

Before maintenance, identify affected sources and their buffering/retry mechanisms. A restart can interrupt log transmission. Even TCP alone does not guarantee that the sending application retains and retransmits all events; UDP carries a corresponding risk of loss. Afterwards, check fresh events and possible gaps for each source. Sophos recommends contacting Support if the collector remains unreachable for more than 30 minutes after a restart.

Start with read-only Admiral commands

Admiral is the collector’s local text console. On-premises, access it through the VM console. In AWS, open the EC2 instance and choose Actions > Monitor and troubleshoot > EC2 serial console > Connect; this requires the appropriate authorized AWS permissions. In Azure, Serial console is under Help on the VM page; in GCP, use Connect to serial console in instance details. Resolve disabled access with the cloud owner rather than spontaneously adding privileges or exposing a new remote access path.

At the prompt, help, Tab completion and ? show the available syntax. Ctrl-C gives a new line without executing a partially entered command. According to Sophos, the following documented show commands read status without generating network traffic:

show system info
show network
show routes
show date
show ntp status
show disk
show memory
show uptime

Use them to compare identity, network configuration, route, time, storage and resources with the expected state. Diagnostic output can contain internal network information; sanitize it before recording it in operational documentation.

run commands can perform actions and create network connections. Targeted, authorized diagnostics include run dns check, run ntp check, run tunnel check and run e2e check. run dns check with verbose output provides more detailed DNS diagnostics. This does not authorize every available action: run reboot and run shutdown schedule a restart or shutdown one minute later. Commands in the maintenance menu, such as service restarts, belong in an agreed support or maintenance procedure, not a read-only initial diagnosis.

Change configuration and prepare for redeployment

Actions > Edit Collector Configuration is available only for a running, healthy collector with Ready status. Before saving, record existing values, required network changes, affected sources and a redeployment path. A configuration change can make the collector unreachable.

After submission, a banner shows the pending change; configuration cannot be edited again until it completes. Sophos tests connectivity and attempts to restore the previous configuration on failure. This automatic rollback can also fail, for example during concurrent network changes. Redeployment may then be necessary. Confirm a success banner with status, source validation and search results as well.

Then save updated deployment files through Actions > Download Collector Files. For cloud collectors, also update the associated cloud template or Terraform deployment so that replacing an instance does not restore old configuration. For an on-premises collector already running, the new ISO does not need to be mounted again; retain it for future redeployment.

Actions > Delete is not a troubleshooting step for an offline collector. Before planned retirement, redirect sources, prove fresh events at the replacement, and clarify rollback and retention. For Support escalation, collect collector/tenant identification, period, source list, status and sanitized Admiral output. Credentials, complete configuration files and unnecessary personal log data do not belong in publicly accessible tickets.