How to enable trace logging for the Sophos Management Service

  • Article ID: 112246
  • Rating:
  • 3 customers rated this article 1.3 out of 6
  • Updated: 11 May 2015

This article explains how to enable the trace logging feature for the Sophos Management Service.

This logging captures errors and warnings from the core of the Sophos Management Service and Enterprise Console.  This trace logging is not just for the management service failing to start but also for a lot of issues that occur inside the console.  Some of the more common reasons for enabling management service trace logging are listed below.

  • Sophos management service fails to start.
  • Console fails to open.
  • Console opens but shows an error (i.e., pop-up error).
  • Console crashes (closes unexpectedly) during normal usage - with or without an error.

Note: The steps below involve the use of the Microsoft tool DebugView to show the output as the trace output is not saved to a file on disk.  For more information on DebugView see article 119577.

Known to apply to the following Sophos product(s) and version(s)
Enterprise Console

What To Do

Depending on the issue being investigated the Sophos Management Service may or may not be started. In scenarios where the service is able to start, it is important that the service is restarted (step 2 below) after trace logging is enabled (step 1) in order to activate the trace logging. It is not necessary to stop the service before enabling trace logging, but only to restart the service after the registry key has been added.

  1. Create a new DWORD registry key called Trace under:
    • 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\


  2. From the Windows services list (Start | Run | Type: services.msc | Press return) restart the Sophos Management Service.
    Tracing is now activated, but there is no visible change and the logging is not being recorded.

  3. To capture and save warning and errors download DebugView.
    You can run DebugView to view the error and also save the capture to a log file if required.  When using DebugView ensure:
    • DebugView is launched as an Administrator (right-click and choose 'Run as administrator' where appropriate)
    • that 'Capture Win32' and 'Capture Global Win32' are selected on the 'Capture' menu.

  4. Prepare to recreate the issue. This may involve restarting an application or service, or by enabling other options (such as registry keys) described in other articles.

  5. Enable the capture by pressing the capture button within DebugView. 

  6. Recreate the issue.

  7. As soon as the issue/event has occurred, stop the capture by pressing the same capture button in step five. Save the log to a location you can later access.

  8. Please send the log file, and an output from Sophos Diagnostic Utility (post-capture) to us for analysis. Either reply to the last email you received from us on the already open case or upload the files to your case with our web form (include your existing case reference). Note: The web form allows files up to 30 MB in size. If the file(s) is still too large consider zipping up the file before emailing/uploading.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent