While stopping symcscan service, Symantec Protection Engine (SPE) 7.0.x crashes and creates hs_error_pid<pid>.log file under / (root) directory on Linux

Products

• Protection Engine for Cloud Services

Issue/Introduction

You have installed Symantec Protection Engine (hereafter SPE) 7.0.x on a Linux host. When you stop symcscan, it does not stop gracefully but crashes.

• /etc/init.s/symcscan stop
• service symcscan stop

You may notice the following files left on the system:

• /hs_err_pid<sse or spe's pid>.log
• /tmp/.java_pid<sse or spe's pid>
• /core.<sse or spe's pid> if ulimit is set to be "unlimited"

A sample of hs_err_pid<pid>.log:

 

#

# A fatal error has been detected by the Java Runtime Environment:

#

#  SIGSEGV (0xb) at pc=0xc0bd8270, pid=3581, tid=3718237072

#

# JRE version: 7.0_11-b21

# Java VM: Java HotSpot(TM) Client VM (23.6-b04 mixed mode linux-x86 )

# Problematic frame:

# C  0xc0bd8270

#

# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again

#

# If you would like to submit a bug report, please visit:

#   http://bugreport.sun.com/bugreport/crash.jsp

#

 

---------------  T H R E A D  ---------------

 

Current thread is native thread

 

siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0xc0bd8270

 

Resolution

This issue was addressed with SPE 7.0.3. 

This crash is not known to be related to any serious problems per se, unless your system explicitly generates core with ulimit settings (ulimit -c unlimtied) and serial stop-time crashes deplete available hard disk space quickly.

Possible mitigation for hard disk depletion issue:

• Peirodically remove core files generated under /, confirming that there are hs_err_pid<PID>.log with matching core.<PID> under /.
• Stop SSE not with service command but with some customized shell script, which first saves SSE's PID, stops the service, and removes resulted core and left-over files right as soon as they are generated.

 

Applies To

• Linux (32-bit and 64-bit)
• JRE 1.6 or 1.7
• SPE 7.0.0 up to SPE 7.0.2 (SSE5.2.5 up to SSE 5.2.14 included but EOSL-ed)