Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 7355 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Server 2012 not shutting down cleanly with event 41

DavidWills

We have Sophos Endpoint 10.3 installed on an AWS Windows 2012 (not R2) server and we automatically shutdown the server every night to save money using an amazon auto-scaling group. When the server fires up in the morning there is an event 41 logged:  

"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

This only happens about 50% of the time, I have looked at 10 days of logs when the shutdown is initiated and the only common factor is that when the server shuts down cleanly the service "Sophos Agent Service" enters a stopped state. When it doesn't and evt41 is logged next morning there is no log entry for the Agent Service. 

This is the only difference between the days with successful and unsuccessful shutdown - all the others services shutdown and are logged including Sophos Web Intelligence, Sophos Anti-Virus.

This has caused an issue once where the machine hung at shutdown and AWS terminated it - losing a days worth of data!

I am pretty sure this is caused by the Sophos Agent service not shutting down correctly or in a timely manner - has anyone got any idea about this?

I have removed and reinstalled Sophos several times to no avail, and I have removed/changed scan/update timings - don't know what else to try.

Dave



This thread was automatically locked due to age.
Parents
  • 0

    Hello Dave,

    usually it's the other way round - the Agent service stopping unexpectedly :-)

    Might be necessary to contact Support. Maybe or not they'll ask you to enable tracing for the Agent - as the logs are recycled this shouldn't cause any issues. Perhaps it'll show where it hangs (but not necessarily how to avoid it). A pragmatic approach would be to explicitly stop the service and check for it having stopped (if it's the only one that constantly causes troubles) as part of the automatic shutdown.

    Christian

  • 0 in reply to QC
    Thanks, that gives me a few more places to look at! I will turn on logging and see what they say before contacting support.

    Dave
Reply Children
No Data
Cookie Information Banner