Sophos Diagnostic Utility (SDU): how to use it to send files to Sophos Technical Support

The Sophos Diagnostic Utility (SDU) collects vital system information as well as log files for all Sophos products that are installed on the computer. The utility also collects suspicious file samples if there are any present.

To download and install the SDU refer to the knowledgebase article Sophos Diagnostic Utility (SDU): how to download and install.

If you have been asked by Sophos Technical Support to install and run the Sophos Diagnostic Utility on an affected computer, once you have installed the Sophos Diagnostic Utility, please read the following instructions on how to run it and how to send the results to Sophos Technical Support.

Running the Sophos Diagnostic Utility

1. If the Sophos Diagnostic Utility is not already open, go to Start|Programs|Sophos|Sophos Diagnostic Utility and select 'Sophos Diagnostic Utility'.
2. In the list of options, select the information you would like the Sophos Diagnostic Utility to collect. Unless you have been instructed otherwise by a member of Sophos Technical Support, you should ensure that all of the options are selected.
3. Click 'Continue'. The utility will take a few minutes to collect all of the data that was selected.
4. When the utility has finished collecting the data, the 'Logs archived' list shows all of the system logs that were found, and the 'Select samples to be archived' list shows any suspicious files that were found.
5. In the 'Select samples to be archived' list, select the suspicious files that you wish to submit to Sophos for investigation.
6. Click 'Archive samples and send to Sophos'. All the information collected will be saved in archive files named sdulogs.sdu and sdusamp.sdu.
7. Please note when sending the .sdu files - do not zip them together into a third archive; Sophos Technical Support relies on the log files being received separately from the sample files which are delivered to Sophos Labs.
8. To send the archive files to Sophos, do one of the following:

   If the affected computer has an email program installed and network/internet access:

   • Find the email from Sophos Technical Support asking you to download the Sophos Diagnostic Utility and note the call reference number from the subject line.
   • In the 'Sophos Reference Number' field, type the call reference number. Please ensure that you type the correct call reference number as there will be a delay in responding to your case if the number is wrong.
   • Enter your company name, contact name and telephone number in the correct fields.
   • Click 'Send mail to Sophos'. Your locally configured mail client will automatically open a new message with the Sophos archive files attached. You do not need to edit this email.
   • Click 'Send' to submit the email.
   • Click 'Exit' to close the Sophos Diagnostic Utility.
   • Read the instructions in Removing the Sophos Diagnostic Utility to remove the program from this computer.

   If the affected computer does not have an email program installed or if you have removed this computer from the network temporarily:

   In order to send the archive files to Sophos, you will need to copy these files to another computer that has internet access and either an email program installed or access to a web-based email program. If the affected computer has internet access, you could send the email to Sophos from there, if you have access to a web-based email program.

   • If you are copying the files to another computer, in the Sophos Diagnostic Utility window, click 'Locate Archives'. The folder containing the sdulogs.sdu and sdusamp.sdu files will open. Select them and copy them to a removable disk.
   • Create a new mail message on the computer you are using to send the files to Sophos.
   • Attach both .sdu files to the message. If you are using a web-based email program on the affected computer, you will find the files in C:\Documents and Settings\<user who ran the utility>\Local Settings\Temp\sdu.
   • In the 'To' field, type support@sophos.com.
   • In the 'Subject' field, type the call reference number from the subject line of the email from Sophos Technical Support that asked you to download the Sophos Diagnostic Utility. Please ensure that you type the correct call reference number as there will be a delay in responding to your case if the number is wrong.
   • In the message body, type your name, your company name and your contact telephone number.
   • Click 'Send'.
   • In the Sophos Diagnostic Utility window, click 'Exit'.
   • Read the instructions in Removing the Sophos Diagnostic Utility to remove the program from this computer.