Sophos Issues related to ??

[#1]

Hello all.

We're having issues with some of the machines that have been imaged in the last 6 months frequently re-installing sophos daily. I'm not sure if this might be related to our use of casper for imaging, but the machines that have this issue have all been imaged using the casper suite. However, the issues doesn't appear to be related to jamf - at least not directly.

I install sophos as a "postinstall" policy that gets called on all imaged machines. It installs a few packages that need to be installed on the live OS including sophos. From the policy logs, it seems to install fine. On several of these machines, we have a recurring sophos install. I thought that it might have been related to a bad policy change (I did this once), but it doesn't appear to be so and our support at sophos doesn't seem to think it's sophos updating itself.

So, here's what I'm seeing:
Jamf indicates that there's nothing being installed. The system log shows nothing as well. The install log starts an install, but we have no idea why and I'm not sure how to figure out the parent process which called it.

Suggestions on how to figure out what is triggering the sophos re-install would be greatly appreciated.

Jamf Log
Sep 16 17:20:26 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[37417]: No Policies were found for the every15 trigger.
Sep 16 17:35:06 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Delaying 136 seconds...
Sep 16 17:37:22 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Checking for policies triggered by "every15"...
Sep 16 17:37:22 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Gathering Policy Information from https://jss.domain.com.com:8443//...

System Log
Sep 16 17:20:26 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[37417]: No Policies were found for the every15 trigger.
Sep 16 17:35:06 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Delaying 136 seconds...
Sep 16 17:37:22 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Checking for policies triggered by "every15"...
Sep 16 17:37:22 Macintosh-0017f20dcd30 com.jamfsoftware.task.Every 15 Minutes[39705]: Gathering Policy Information from https://jss.domain.com:8443//...

Install Log
Sep 16 12:35:19 2668-mp /usr/sbin/progress_emitter[70]: BonjourDataEmitter - netServiceWillPublish
Sep 16 12:35:20 Macintosh-0017f20dcd30 /usr/sbin/progress_emitter[70]: BonjourDataEmitter - netServiceDidPublish
Sep 16 17:34:13 Macintosh-0017f20dcd30 installdb[39162]: started (uid 96)
Sep 16 17:34:13 Macintosh-0017f20dcd30 installdb[39162]: Opened receipt database on '/' with schema 17.
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVCLI2.07.282 / com.sophos.sav.cli.7.1.10.installer): (SophosAVCLI2.07.282 / com.sophos.sav.cli.7.1.10.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosRMSLibs7.1.0 / com.sophos.rms.libs.7.1.0.installer): (SophosRMSLibs7.1.0 / com.sophos.rms.libs.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVOnAccess7.1.8 / com.sophos.sav.ic.7.1.8.installer): (SophosAVOnAccess7.1.8 / com.sophos.sav.ic.7.1.8.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVSrv7.1.7 / com.sophos.sav.srv.7.1.7.installer): (SophosAVSrv7.1.7 / com.sophos.sav.srv.7.1.7.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosSecurityLibs7.1.0 / com.sophos.security.7.1.0.installer): (SophosSecurityLibs7.1.0 / com.sophos.security.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVSUMScanKit7.1.9 / com.sophos.sav.sumscankit.7.1.9.installer): (SophosAVSUMScanKit7.1.9 / com.sophos.sav.sumscankit.7.1.9.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAUCLI7.1.0 / com.sophos.sau.cli.7.1.0.installer): (SophosAUCLI7.1.0 / com.sophos.sau.cli.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVImmediate7.1.7 / com.sophos.sav.gui.7.1.7.installer): (SophosAVImmediate7.1.7 / com.sophos.sav.gui.7.1.7.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosRMSMsgRouter7.1.0 / com.sophos.rms.router.7.1.0.installer): (SophosRMSMsgRouter7.1.0 / com.sophos.rms.router.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosLibs7.1.0 / com.sophos.libs.7.1.0.installer): (SophosLibs7.1.0 / com.sophos.libs.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosRMSAVAdptr7.1.7 / com.sophos.rms.sav.7.1.7.installer): (SophosRMSAVAdptr7.1.7 / com.sophos.rms.sav.7.1.7.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosRMSAUAdptr7.1.5 / com.sophos.rms.sau.7.1.5.installer): (SophosRMSAUAdptr7.1.5 / com.sophos.rms.sau.7.1.5.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVSAVI2.08.282 / com.sophos.sav.savi.7.1.10.installer): (SophosAVSAVI2.08.282 / com.sophos.sav.savi.7.1.10.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVFinderPlugin7.1.0 / com.sophos.cmplugin.7.1.0.installer): (SophosAVFinderPlugin7.1.0 / com.sophos.cmplugin.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAUSrv7.1.0 / com.sophos.sau.srv.7.1.0.installer): (SophosAUSrv7.1.0 / com.sophos.sau.srv.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosRMSMgmtAgent7.1.0 / com.sophos.rms.agent.7.1.0.installer): (SophosRMSMgmtAgent7.1.0 / com.sophos.rms.agent.7.1.0.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosUI7.1.10 / com.sophos.ui.7.1.10.installer): (SophosUI7.1.10 / com.sophos.ui.7.1.10.installer)
Sep 16 17:34:14 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVData4.57 / com.sophos.sav.data.7.1.10.installer): (SophosAVData4.57 / com.sophos.sav.data.7.1.10.installer)
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFPKGDerivedDocument sortedPackageLocations]: result = ( file://localhost )
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: location = file://localhost
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVSAVI2.08.282.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVData4.57.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVSrv7.1.7.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVOnAccess7.1.8.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVImmediate7.1.7.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVCLI2.07.282.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVSUMScanKit7.1.9.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg/Contents/Packages/SophosAVFinderPlugin7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAV.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosSecurityLibs7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAU.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAU.mpkg/Contents/Packages/SophosAUSrv7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAU.mpkg/Contents/Packages/SophosAUCLI7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosAU.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosLibs7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg/Contents/Packages/SophosRMSLibs7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg/Contents/Packages/SophosRMSMsgRouter7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg/Contents/Packages/SophosRMSAVAdptr7.1.7.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg/Contents/Packages/SophosRMSAUAdptr7.1.5.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg/Contents/Packages/SophosRMSMgmtAgent7.1.0.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosRMS.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg/Contents/Packages/SophosUI7.1.10.pkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: -[IFDInstallController(Private) _buildInstallPlan]: file://localhost/Library/Caches/com.sophos.sau/CID/Sophos%20Anti-Virus.mpkg
Sep 16 17:34:15 Macintosh-0017f20dcd30 installer[39139]: _installNextPackage of 1
Sep 16 17:34:15 Macintosh-0017f20dcd30 runner[39185]: Administrator authorization granted.
Sep 16 17:34:16 Macintosh-0017f20dcd30 installer[39139]: Found receipt (full match) for (SophosAVSAVI2.08.282 / com.sophos.sav.savi.7.1.10.installer): (SophosAVSAVI2.08.282 / com.sophos.sav.savi.7.1.10.installer)
...lots of stuff...
Sep 16 17:34:34 Macintosh-0017f20dcd30 installer[39139]: Removing temporary directory "/private/tmp/Sophos Anti-Virus.mpkg.39139r7FIwG"
Sep 16 17:34:34 Macintosh-0017f20dcd30 installer[39139]: Finalize disk "MacHD"
Sep 16 17:34:34 Macintosh-0017f20dcd30 installer[39139]: Notifying system of updated components
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: _installNextPackage of 0
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: ** Summary Information **
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Operation Elapsed time
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: -----------------------------
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: script 9.84 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: zero 0.05 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: install 5.35 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: validate 0.00 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: os 0.00 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: extract 2.37 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: receipt 4.65 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: disk 1.01 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: config 0.14 seconds
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Starting installation:
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Finalizing installation.
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registering applications
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/Applications/Sophos Anti-Virus.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registered /Applications/Sophos Anti-Virus.app.
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/Library/Sophos Anti-Virus/InterCheck.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registered /Library/Sophos Anti-Virus/InterCheck.app.
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/Library/Sophos Anti-Virus/SophosAntiVirus.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registered /Library/Sophos Anti-Virus/SophosAntiVirus.app.
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/Library/Sophos Anti-Virus/SophosAutoUpdate.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registered /Library/Sophos Anti-Virus/SophosAutoUpdate.app.
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/Library/Sophos Anti-Virus/SophosUIServer.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 installer[39139]: Registered /Library/Sophos Anti-Virus/SophosUIServer.app.
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus/SophosUIServer.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus/SophosAutoUpdate.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus/InterCheck.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus/SophosAntiVirus.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Library/Sophos Anti-Virus'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Applications/Sophos Anti-Virus.app'
Sep 16 17:34:35 Macintosh-0017f20dcd30 runner[39185]: Touched '/./Applications'