menubar icon vanished, can't get it back

Reboot/logout-in is best.  But you could try running the process from Terminal in the mean time.

/Library/Sophos\ Anti-Virus/SophosUIServer.app/Contents/MacOS/SophosUIServer 

 Example:

Thanks.  I tried separately killing each of the seven "Sophos<...>" processes, causing each to be automatically respawned, but none restored the menubar icon.  Eventually I did log out and the icon finally returned.  But I hope it is not now necessary to log out every time the icon disappears.  Would manually spawning SophosUIServer have a different effect than the (ineffective) automatic respawn, and if so, how would I prevent the automatic respawn?  If the pertinent difference between logging out and killing the seven "Sophos<...>" processes and SystemUIServer could be identified, then maybe it could be replicated without logout.

I'd suggest upgrading to v9.1 and seeing if the problem continues...

http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/SAV-for-Mac-9-1-Preview/td-p/18025

...if it does I recommend keeping an eye on the menu bar and recording how often the shield disappears - if it still happens on v9.1 and happens a lot we can investigate it.  However I'd suggest that as this is the only thread on the issue (so far at least) maybe there is something on the Mac that is conflicting with the process.

Anyway, hopefully an upgrade will help.  You may like to uninstall first and then run the v9.1 installer (not required, but maybe help)...

http://openforum.sophos.com/t5/Mac-tools-help/Remove-uninstall-Sophos-Anti-Virus-for-Mac-Home-Edition-the-free/td-p/14271

I'll try 9.1 next and report back.  Meanwhile, I discovered what makes the icon disappear on 9.0.11:  restarting (killing) the Finder.  I can't imagine anything else it could be but a Sophos bug.

In case there's a question, restarting the Finder is the conventional way to switch between showing and not showing hidden files:  toggle com.apple.finder AppleShowAllFiles and kill.  But also, very recently, Finder memory started leaking, and when it gets very large it starts thrashing (consuming CPU), requiring periodic killing.

I suspect a Sophos version 9 bug for three reasons.  One, the Finder never leaked with version 8, only started leaking some time after the upgrade.  Two, WindowServer, which always leaked with versions 6-8, suddenly STOPPED leaking some time after the upgrade.  And three, nothing else that runs continuously on my machine has changed in that time.

Sadly, 9.1.5 doesn't seem to have helped.  Running the installer (without uninstalling 9.0.11) restored the menubar icon, but shortly after relaunching the Finder via the Apple menu, it disappeared again.  And not immediately, which was interesting.

Hmmm, this is also interesting (and new):

7/29/14 7:59:24p    com.apple.launchd.peruser.501[116]    (com.apple.Finder[97121]) Exited: Terminated
7/29/14 7:59:44p    com.apple.launchd.peruser.501[116]    (com.sophos.uiserver[97477]) Exit timeout elapsed (20 seconds). Killing

That looks to me like the menubar icon has become unnecessarily dependent on the Finder.

Thanks for posting back.  I'll ask our development team to comment.

---

kwiniec wrote:

That looks to me like the menubar icon has become unnecessarily dependent on the Finder.

---

Its not dependent on Finder (nor could it really cause Finder to have memory leaks).

Back in the version 8 days we used the "Login Items" feature to request that the system launch the SophosUIServer.app when someone logs in. However this mechanism is flakey, doesn't always work well, and is very dependent on which version of Mac OS X in use. We switched to using Launch Services, and have set SophosUIServer.app as something called a Launch Agent.

https://developer.apple.com/library/mac/documentation/macosx/conceptual/bpsystemstartup/chapters/CreatingLaunchdJobs.html

It appears that simply killing Finder is not the same as a login event, at least with how Launch Services works. I tried this on 10.9, and did not have the same behavior as you described for 10.6. The menu bar (including our shield icon) stays around even while Finder is trying to relaunch.

> Its not dependent on Finder

Of course that statement cannot be accurate for 10.6 since if it were, killing the FInder would not cause the shield icon to vanish.  My understanding is the Finder is just an application; some users run a 3rd-party alternative, and some don't run anything at all.

>The menu bar (including our shield icon) stays around even while Finder is trying to relaunch.

This is true for 10.6 as well.  The only thing that happens is that the shield icon quietly shuffles off this mortal coil.

I located SophosUIServer.app, and manually starting it restores the icon.  Subsequently relaunching the Finder produces:

7/30/14 3:11:18p    com.apple.launchd.peruser.501[116]    (com.apple.Finder[97509]) Exited: Terminated
7/30/14 3:11:18p    [0x0-0x2af4af2].com.sophos.ui[98406]    Wed Jul 30 15:11:18 Mmmmpie.local Sophos Distant Object[98406] <Info>: [NSTask+Extensions.m:65] Launching task /bin/launchctl with args: [unload, /Library/LaunchAgents/com.sophos.uiserver.plist] uid: 501, euid: 501
7/30/14 3:11:18p    [0x0-0x2af4af2].com.sophos.ui[98406]         for task: /bin/launchctl with args: [unload, /Library/LaunchAgents/com.sophos.uiserver.plist]
7/30/14 3:11:18p    [0x0-0x2af4af2].com.sophos.ui[98406]    Starting up: SGBackgroundServiceMain,287

So basically I have to manually start SophosUIServer.app every time.  Do you intend to fix this?

Also, it seems like selecting the "Show Status in Menu Bar" menu option or toggling the "Show Sophos Anti-Virus status in the menu bar" preference should start SophosUIServer.app, but it doesn't.  Is that as intended?

---

kwiniec wrote:

> Its not dependent on Finder

---

Just so I'm very clear on your report, you are going to the Apple menu, selecting Force Quit, selecting Finder, pressing Relaunch. Correct?

---

kwiniec wrote:

Also, it seems like selecting the "Show Status in Menu Bar" menu option or toggling the "Show Sophos Anti-Virus status in the menu bar" preference should start SophosUIServer.app, but it doesn't.  Is that as intended?

---

That menu item assumes that the Launch Agent (SophosUIServer.app) is already running. It assumes the system has done its job to launch it at user login.

---

kwiniec wrote:

So basically I have to manually start SophosUIServer.app every time.  Do you intend to fix this?

---

We are unlikely to do anything about it. Its a side effect of how 10.6 works when relaunching the Finder. You might be interested to know the system will work as you expect for 10.7+. Relaunching the Finder has no impact on the loaded Launch Agents.

> Just so I'm very clear on your report, you are going to the Apple menu, selecting Force Quit, selecting Finder, pressing Relaunch. Correct?

Yes.  Additionally, the same effect is seen with the "killall Finder" shell command and the 'quit application "Finder"' AppleScript command used by common show-hidden-files scripts.

> That menu item assumes that the Launch Agent (SophosUIServer.app) is already running. It assumes the system has done its job to launch it at user login.

It also assumes nothing has happened to the SophosUIServer process in the meantime.  And you know what they say about assuming....  ;-)

>  We are unlikely to do anything about it.

Ok, it's easy enough to work around on my end.  Note however that this means the claim of "Compatibility - Mac OS X 10.6 or Later" is inaccurate without a caveat.

Thanks for all the information.