Sophos to force users to the latest version

[john]

Just received the Sophos Products newsletter and an horrified to see that they are forcing us to upgrade to V6.5 unless we modify our configurations to stop it doing so.

 

I have used V6 and it caused us so much work I don't want to use it until they fix the astronomical client ram usage (as has been discussed on here recently).

 

Below is the extract from the newsletter from Sophos:

 

Advance notice of automatic upgrade

----

 

In January 2007 we will begin automatically updating the 'latest' package for Sophos Anti-Virus for Windows 2000/XP/2003 version 5 to Sophos Anti-Virus for Windows 2000/XP/2003/Vista version 6. Any computers that are updating from a Central Installation Directory using the latest package and any computers updating directly from Sophos will automatically be updated to version 6.

This uses the same process as any monthly update and will be invisible to the user, although the size of the update will be larger than a typical monthly update. All settings will be preserved.

 

Version 6 brings a lower memory footprint and improved performance on lower spec machines, as well as optional additional adware/PUA detection and cleanup. Clients running version 6 can still be managed from Enterprise Console version 1. However we recommend upgrading first to Enterprise Console version 2.

 

Customers who wish to remain on version 5 after January and to manage the upgrade themselves, are advised to use EM Library to select a 'fixed' (IDEs only) version 5 package from the es-central2 databanks and to update Central Installation Directories from that fixed package.

Details of how to do this can be found at

 

http://www.sophos.com/support/knowledgebase/article/17586.html

 

Please note that support and automatic updates for version 5 will end at the end of June 2007.

 

So those who don't want any clients with under 512mb ram being useless with Sophos on them need to react to this now before its too late. I know I am going to.

[Geoff]

What about v4. Is support for that still scheduled to end in Jan 07?

[ITWombat]

Are Sophos actually aware of the memory leak?

[plexer]

No-one said it was a memory leak:

 

don't want to use it until they fix the astronomical client ram usage

 

Just the client needing lots of ram.

 

Ben

[tosca925]

We upgraded to V6 earlier this week and to be honest i have not had any problems at all. We have monitored certain machines and no one has complianed, What size RAM do you have in the PC's?

[ajbritton]

Some sites we support (against our advice) had some XP machines with 128 Mb RAM, which became unusable under the latest version of Sophos. Some PCs with 256 Mb have slowed noticeably. Our bare minimum purchase spec is now 512 Mb, with 1024 Mb strongly recommended.

[john]

Our bare minimum purhcase is 512MB, but machines having a 5/6 year lifecycle means we have some with 128 and 256 still, and when its PC133 in quite a few of those machines its hard to justify the cost of upgrading them to 512. I tried it on them and it was crazy the 128's were un-usable end of, and the 256's were practically unsuable, once you were logged on, and opened say Outlook and then Internet explorer you were stuffed if you wanted to do anything else.

 

The memory leak was in V5, which seems to have slowed quite well now I must admit, then again my server that has the servery stuff on has got 2GB ram instead of 384mb so its a bit more powerful, so takes a lot longer before its eaten all that ram. The clients don't seem to leak just consume a lot more ram than the previous version, I hate to think what they would be like if you used the client firewall as well! I sense that Sophos has been taking lessons from McAfee and Norton who are quite well known in the home circuit for large footprint programs and think they can get away with it!

[tosca925]

Have you had any issues with logon times becoming longer?

[john]

With Sophos V6 on yes, but as soon as we removed it it went back to normal, so we decided again it was a Sophos related item, but by that point we had decided to call an end to V6 and did without anything on the clients for a few weeks to decide what to do, and then went back to V5.

[tosca925]

We deployed it last week and i am getting slow log on times on certain machines now, but I have issues t consider at the moment but i noticed slow log on times before i did any of the other changes. This was on a machine with 512ram as well.

 

We upgraded to V6 because we have had 2 ^64 bit servers so we had to to protect them. May have to look at putting V5 on all workstations again.....bugger.

 

Is it a Ram issue or could it be anything else?

[john]

It didnt seem to be too CPU intensive just ram and V-ram intensive. I would assume that if you use roaming profiles maybe Sophos is being rather more thorough with the scanning perhaps on logon? or its just being annoying to wind you up On a +ive note V5 installs over V6 with ease so no issues there, I would stick V5 on everything and just do 2 manual installs of V6 on your new 64bit servers that will solve your issues for now, and see what V6.5 brings next month.

[Ric_]

@tosca925: You could try an exception so that profiles aren't scanned (they should get scanned by a scheduled scan on the server anyway). This should reduce memory usage.

[tosca925]

Cheers RIC,

 

Been playing with the exception sceanrio today. Not had mmuch user feedback yet but should know more whenthe log on tomorrow.

 

Just out of interest how often do you run scheduled scans on your servers?

[ChrisH]

You can set it in the policies.

[tosca925]

But how often do you run them?

[ChrisH]

Sorry didnt read properly I have mine scan once a day at night. Anything found in the user files should be picked up by the workstations sophos in the meantime.

[john]

Mine scan daily at 3am

[Ric_]

My main servers do a daily scan at night. My terminal servers do a daily scan at night and one during lunchtime. My clients use on-access scanning so any files brought in on removable media should get scanned as they are accessed.

 

This isn't a perfect setup but it does overcome the high memory usage slightly on the terminal servers - although memory usage is still too high IMHO. Obviously files downloaded from the Internet don't get scanned but I have blocked executable files using ISA to try to overcome this slightly.

[wellwillthisnamedothen]

Oh dear, I feel a faint spell coming on

 

I am a peripatetic technician and one of my schools runs Sophos (installed by NS Optimum, but that’s another thread). Logons are very slow now, I thought that was the Ethernet switch problem (installed by NS Optimum, could be another thread). But now it seems it could be Sophos.

 

Hertfordshire pays for McAfee so I could find how to take Sophos off and install McAfee, but there seems to be problems there too.

 

I’m paid for 3 hours a week at this school, I’ve got 25 computers and a 2 servers to do, which way do I jump, McAfee or SophosV5, what do I do to get 5 minutes to fix the printer?

[john]

I would probably jump back to V5 Sophos, its really simple as you can re-deploy it over the V6 install (how nice of Sophos to build this feature into it ) Just get hold of a copy of the Enterprise Solutions pack V1.0 like I did, uninstall and remove every single trace of it from your servers, so thats enterprise console, em library and the actual client, remove all files from program files, remove all registry keys for it and then intall it, set it up again for updates from Sophos etc, set the policys up and away you go, deploy it to clients from there and you should be good to go. V6 will be gone fairly easily.

[wellwillthisnamedothen]

Gulp,

 

That easy is it, I'll have to give it a go.

[john]

It is , honest! I think I made it sound just over complex there stuffing it all together in one line, but it is fine, done it myself twice and I can do it with my eyes closed now, honest!

[tosca925]

Enterprise Solutions pack V1.0

 

From where?

[wellwillthisnamedothen]

Thanks,

 

Can I open my eyes when I get to fixing the printer?

[john]

@tosca925, good point my friend, I suspect I may need to dig it out off my memory stick and host it really as its not on the Sophos site anymore. I will find it, upload it and post a link for anyone to download it, probably best as an evening download as it is just over 100MB from memory.

 

Edit- Uploading now to my webspace so will post a link when its up there and completed and ready for download.