Sophos Anti-Virus for Linux, version 6 and later, does not pass alerts on to Enterprise Console during a savscan (on-demand) scan.
What to do
The Daemon (savd) has been stopped on the computer. If savd is disabled on a managed computer (endpoint), and the command line scanner savscan is used to scan an infected file, the virus is reported locally, but no alert is sent to Enterprise Console.
If alerts must be sent to Enterprise Console, rather than managed locally, start the daemon (savd) by typing: