If on the client you enable trace logging does that help shed some light on the issue? For example, under... 64-bit: hklm\software\wow6432node\sophos\web intelligence\ 32-bit: hklm\software\sophos\web intelligence\ ...if you create a new DWORD called loglevel and set it to 3. Restart the Sophos Web Intelligence service you will get a number of logs. The one of interest here would be the swisdiag.log under \windows\temp\. This is the trace log of the swi_service. I would suggest once collected you delete the log level DWORD and restart the computer. After restart remove all swi logs that have been created under: %temp% and \windows\temp\ Hope it helps, Jak
↧