Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 9 subscribers
  • Views 2366 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Device Encryption Service (Automatic Delayed Start) could not be started. Could not load file or assembly 'log4net'

Nikola Djurdjevic

Hi all,

I have noticed on 2 of my machines that Sophos Deceive Encryption Service cannot be started. I have checked this KB article https://community.sophos.com/kb/en-us/132320 but my service have been already set on Automatic Delayed Start.

When I have tried to start service manually I have got this message:

Sorry, message is in French. English translation would be something like this: System.BadImageExpcetion: Could not load file or assembly 'log4net, version=1.2.15.0' or one of its dependencies. 

It seams that this service cannot be started because service itself or some of it's dependencies is using Log4net.dll and that DLL cannot be found or loaded.  However, log4.net.dll is located in same folder where application resides. 

Event Viewer says:

It seams that LoggerServerConfiguratior cannot initialize (configure) logger.

Installed .Net version is 4.7.2

Any ideas what could went wrong ?

Kind regards,

Nikola Djurdjevic



This thread was automatically locked due to age.
  • 0

    This is strange. In previous 2 days, I tried everything to start this service in order to solve BAD device status. I have restarted several times PC and nothing helped. Suddenly Health status has changed to Good and all services are running however there is no more Sophos Device Encryption (Automatic Delayed Start) service.

    Here is the content of the events tab.

    On client itself says that Sophos Device Encryption Service has been uninstalled.

    Why service has been uninstalled ?

     

     

     

  • +1 in reply to Nikola Djurdjevic

    It sounds like log4net.dll in
    C:\Program Files (x86)\Sophos\Sophos Data Protection\

    became corrupt.  Did the computer suddenly shutdown at some point between the health being good and the service failing to start?  The Windows System event log might mention this.

    You could run a file compare against the AutoUpdate cache to check, the files should be the same, if not you could copy the one from the cache:

    fc "C:\Program Files (x86)\Sophos\Sophos Data Protection\log4net.dll" "c:\ProgramData\Sophos\AutoUpdate\Cache\decoded\enc\ProgramFilesFolder\Sophos\Sophos Data Protection\log4net.dll"

    As for how the service went missing is a little odd.  It is possible you can remove the component from the Manage Endpoint Software button on this page:
    https://central.sophos.com/manage/endpoint/bulk-computers
    This will cause Sophos AutoUpdate to remove the component.  But it sounds like just the service was remove as you'd probably remember this.  Maybe the remove/add from this workflow would repair the component though?

    Probably need to check any logs of the component to see if the installer was run and what happened.  These would be under \windows\temp\ if AutoUpdate ran the data protection installer at somepoint.

    Regards,
    Jak

  • 0 in reply to jak

    Hi Jak, 

    Thank you for your reply. 

    There was unplanned shutdown of system after Sophos migration (We have used Migration tool to migrate Sophos from SEC to Sophos Central). I'm not sure was status was GOOD after installation or there was BAD status since beginning. 

    Unfortunately, I don't have same folder structure you have asked me to check. There is no folder: C:\Program Files (x86)\Sophos\Sophos Data Protection nor c:\ProgramData\Sophos\AutoUpdate\Cache\decoded\enc

    I didn't use Manage Endpoint Software button to manage software on clients, however it showed me something which might be the reason why service has been uninstalled. 

    In meantime, my colleague have applied licence keys (we were using trial) but he has applied only licence for Endpoint Protection and Server Protection products without Encryption. Encryption licence will arrive soon. 

     

    So this probably initiate uninstall of Encryption service. 

    I will wait until Encryption licence arrive and see will it install new component (service) without problems. 

Unfiltered HTML