While stopping symcscan service, Symantec Protection Engine (SPE) 7.0.x crashes and creates hs_error_pid<pid>.log file under / (root) directory on Linux

Article Id: 157798
Status: Published
Updated On: 15-06-2014 23:13
Legacy Id: TECH203722
Products:
Protection Engine for Cloud Services
Issue/Introduction:

You have installed Symantec Protection Engine (hereafter SPE) 7.0.x on a Linux host. When you stop symcscan, it does not stop gracefully but crashes.

  • /etc/init.s/symcscan stop
  • service symcscan stop

You may notice the following files left on the system:

  • /hs_err_pid<sse or spe's pid>.log
  • /tmp/.java_pid<sse or spe's pid>
  • /core.<sse or spe's pid> if ulimit is set to be "unlimited"
A sample of hs_err_pid<pid>.log:
 
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0xc0bd8270, pid=3581, tid=3718237072
#
# JRE version: 7.0_11-b21
# Java VM: Java HotSpot(TM) Client VM (23.6-b04 mixed mode linux-x86 )
# Problematic frame:
# C  0xc0bd8270
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
#
 
---------------  T H R E A D  ---------------
 
Current thread is native thread
 
siginfo:si_signo=SIGSEGV: si_errno=0, si_code=1 (SEGV_MAPERR), si_addr=0xc0bd8270
 

Resolution:

This issue was addressed with SPE 7.0.3. 

This crash is not known to be related to any serious problems per se, unless your system explicitly generates core with ulimit settings (ulimit -c unlimtied) and serial stop-time crashes deplete available hard disk space quickly.

Possible mitigation for hard disk depletion issue:

  • Peirodically remove core files generated under /, confirming that there are hs_err_pid<PID>.log with matching core.<PID> under /.
  • Stop SSE not with service command but with some customized shell script, which first saves SSE's PID, stops the service, and removes resulted core and left-over files right as soon as they are generated.

 


Applies To

  • Linux (32-bit and 64-bit)
  • JRE 1.6 or 1.7
  • SPE 7.0.0 up to SPE 7.0.2 (SSE5.2.5 up to SSE 5.2.14 included but EOSL-ed)