search cancel

Multiple java threads remains open for Symantec Event Agent when Liveupdate option is enabled


Article ID: 157295


Updated On:


Security Information Manager


Liveupdate option has been enabed in Agent Configuration and since there are multiple java.exe processes running in task manager



Run the command specified below:
wmic /OUTPUT:.\ProcessList.txt path win32_process get Caption,Processid,Commandline


In the output you should see the following java processes

1. Agent Service.
java.exe               -server -XX:NewRatio=3 -Xmx512m -
Dnetworkaddress.cache.ttl=300 -classpath "C:\Program Files\Symantec\Event
Agent\jre\lib\rt.jar" -jar cimom.jar -p 5998 -auto -sk 56b4d633-25b7-4ef1-a7f8-
0fa34899c258 -svc
2. Agent manager Service
java.exe               -server -XX:NewRatio=3 -Xmx512m -
Dnetworkaddress.cache.ttl=300 -classpath
cimom.jar;agentmanager.jar;sesafwdprov.jar;agentcmd.jar C:\Program Files\Symantec\Event Agent\jre -svc
3. Daemon thread that invokes the Live update from our Agent.
java.exe               "C:\Program Files\Symantec\Event Agent\jre\bin\java.exe"
-jar "C:\Program Files\Common Files\Symantec Shared\SES\bin\sesa-jlu-
launcher.jar" "C:\Program Files\Symantec\Event Agent\jre\bin\java.exe"
.;\jlu.jar .\sesa-jlu-launcher.log -k -d [ -p SESA Agent -v 4.7 -l English -t
update -z 2 ]
4. Daemon thread that actually runs the Live update.
java.exe               "C:\Program Files\Symantec\Event Agent\jre\bin\java.exe"
-cp ".;\jlu.jar" -k -d [ -p SESA Agent -v 4.7
-l English -t update -z 2 ]





This is the expected behaviour since it is a scheduled service that is running in the background

Applies To

This has been observed on Symantec Event Agent version 4.7.1 and SSIM 4.7.4 Patch 10