Sophos File Scanner Hight Hardware Usage

Top Replies

• 

  Sophos User930 over 3 years ago in reply to Tamoor Sohail +1

  If the SophosFileScanner.exe process (child, worker process) is using high CPU, it is very likely to be scanning files as that's most of what it does.

  The log files "C:\ProgramData\Sophos\Sophos File Scanner\Logs\SophosFileScanner.log" and the archives logs with Information level enabled will detail what is being scanned. The idea behind the PowerShell command is to tail the log, picking out the files being scanned from the log.

  You would expect that running the above when the CPU was high would reveal, the areas of disk being scanned.

  Another "brute force" option, would be to start with high level exclusions, these could at least prove that an exclusion would help.

  For example, in policy, if you exclude:
  C:\
  from real-time scanning, I assume the issue goes away?

  If so, change it to:

  C:\users\

  Does the issue go away then? The log file approach should avoid this but it is another option.

  With each policy change check the reg value OnAccessExcludeFilePaths under:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\Scanning\Config
  To ensure it has made it.
  Jump to answer