Hey all you all protected folks out there this is Jelan from Sophos
support and today we're looking at different ways to run the Sophos
diagnostic utility, or SDU. So if you've raised the case with Sophos support we'll
sometimes need detailed logging and system information to troubleshoot. So
we'll ask you to run the SDU on your affected device. What the SDU does is
pull Sophos logs, event logs, and other system information into a zip file which
we can then extract and review. Now there's a few different options for
running the SDU on an Endpoint depending on the software that you use
so you can check out the timestamps in the video description and skip ahead to
the best method for your scenario. So for Sophos Central there's three ways
to run the SDU. The first is running it remotely from Sophos central. From the
dashboard we'll navigate to the affected endpoint or server,
this can be Windows or Mac, the steps are the same. On the left hand side we'll
click diagnose and in the pop-up will go ahead and click run. Now this will send a
request to the Endpoint to run the utility and upload the generated zip
file directly to our servers. Once it's finished running the status of the
button will change back to diagnose and if we scroll down to the bottom we'll
see the last run time and filename. When the SDU is finished
it won't notify support automatically so you'll need to provide this filename to
support to locate your file. Now the machine must actually be turned on for
this to work but the request will keep trying for 14 days if it's not turned on
right away. Next we'll look at running the SDU on the endpoint itself. We'll
open up the endpoint GUI and click about in the bottom right hand corner. We'll
click run Diagnostics tool and click Launch SDU. Now let's accept the
conditions and hit start. This should take about one to five minutes to
complete in most cases. Once that's done we'll hit submit and we'll have two
options: if we choose upload to Sophos the utility will upload the zip file
directly to the Sophos servers. Once that's done it'll display a link to
provide to Sophos support to access the files. Our other option is to submit it
through a browser. This option is really only if you need to create a new case, as
it will open up the browser to the open a support case page.
You can fill in the information and use the open folder option in the SDU to
find the SDU file to upload. So we'll click open folder, that's going to open
up the temp folder, that's where the SDU is stored and we'll just copy and paste
that path into the upload window. The SDU file will be a zip file named after the
computer it's been run on with the date. If you need to get back there after
you've closed the SDU, you can navigate to %temp%.
The last option for central but really applies to both is to
download and run the SDU manually. This can be useful in the case of an
install failure where the SDU wasn't fully installed on the system. In the SDU
KB article, which is available in the video description, we'll scroll down to
the bottom to the download SDU for Windows section and click the hyperlink.
We'll agree to the terms and conditions and fill out the EULA which everybody
loves, and hit submit to download.
We'll go ahead and extract the zip file downloaded and you want to run the sduguI.exe
after that we'll go through the same steps to submit directly to
Sophos, and remember you'll need to provide us with the link displayed at
the end so we could find your files. Now if you're on a Mac you won't have the
same options, it'll look a little different when you launch the SDU. And
once it's complete it'll actually just output a zip file directly onto the
desktop. You can then provide that file to support via email or FTP if the file's
large. So if you're running endpoints managed by the enterprise console, the
easiest way to run the SDU is from the auto update cache. First we'll navigate
to C>program data>Sophos>autoupdate> cache>sizeXP>diagnose. Now there's
a file inside of the diagnose folder called the sdugui.exe and we're going to
need to run that but we can't run it directly from this folder in 'program
data'. So we're just gonna copy this folder over to the desktop, and once
we're in there we're gonna run the sdugui.exe and hit start. This should take
about one to five minutes to complete in most cases. Once that's done we'll hit
submit and we'll have two options. If we choose upload to Sophos the utility will
upload the zip file directly to the Sophos servers. Once that's done it'll
display a link to provide to Sophos Support to access the files. Our other
option is to submit through a browser. This option is really only if you need
to create a new case, as it will open up the browser to the open a support case
page. You can fill in the information and use the open folder option in the SDU to
find the SDU file to upload. And we'll just copy and paste that path into the
upload window. The SDU file will be a zip file named after the computer it's been
run on with the date. If you need to get back there after you've closed the SDU
you can navigate to %temp%
Now your other option for enterprise console manage endpoints is to run the
SDU from a distribution location or CID. We'll navigate to the update server from
the endpoint. Go to Sophos update> CIDs,
select the appropriate CID the endpoint updates from. Go into the SAV folder>SAVXP>diagnosed
And we'll run the SDU GUI just like the previous section. So thanks
for watching everyone if you had any further questions feel free to check out
the SDU documentation links in the video description or view and post questions
at community.sophos.com. That's it for me today,
stay safe out there.