Sophos Endpoint Security and Control: reading RMS log files
The Sophos Endpoint Security and Control Remote Management System (RMS) log files can be found in the locations below.
Version 7 and above on Windows 2000+
- C:\Documents and Settings\All Users\Application Data\Sophos\Remote Management System\3\Agent\Logs
- C:\Documents and Settings\All Users\Application Data\Sophos\Remote Management System\3\Router\Logs
Version 4.7 and above on Windows NT
- C:\WINNT\Profiles\All Users\Application Data\Sophos\Remote Management System\3\Agent\Logs
- C:\WINNT\Profiles\All Users\Application Data\Sophos\Remote Management System\3\Router\Logs
See: Sophos Endpoint Security and Control for Windows: log files for a full list of log files.
What to do
To check for error messages in RMS log files, go to the computer in question:
- Browse to the relevant log file (e.g. for the router log, C:\Documents and Settings\All Users\Application Data\Sophos\Remote Management System\3\Router\Logs)
- Select the most recent log, by date
- Scroll to the bottom of the log file and look for error messages.
In the RMS log files, error messages are indicated by a letter 'E' in the Type column. For example, the following messages are logged on a workstation:
03.02.2005 12:03:38 05D8 I Getting a new router certificate...
03.02.2005 12:13:39 05D8 I Timed out, resending certification message...
03.02.2005 12:08:28 03CC E Failed to read in the router's IOR from the supplied address and port
03.02.2005 12:08:28 03CC E NoRouterIORException: Caught MessagingSystemClientLib::NoRouterIORException (failed to get router's IOR from supplied address and port) ClientConnection::Reconnect()
For example, the 'Failed to read...' error above indicates that the router on the workstation was unable to connect to the server router and obtain the IOR.
- Most common RMS errors involve connectivity or timeout problems. Check the message in the log.
- If you need to contact technical support, give full details and have the log extract available.
If you need more information or guidance, then please contact technical support.
- Article ID: 13019
- Created: 25 Apr 2005
- Last updated: 22 Oct 2008
