symap is not loaded after install Endpoint Protection for Linux 14.2 MP1 over 14.0 RU1 MP1

Products

• Endpoint Protection

Issue/Introduction

You installed Symantec Endpoint Protection for Linux (SEPFL) 14.0 RU1 MP1 on Red Hat Enterprise Linux 6.5 (kernel 2.6.32-431).
You upgraded OS kernel to 2.6.32-754 then install SEPFL 14.2 MP1 over 14.0 RU1 MP1.

After install, symap is not loaded and auto-protect status is malfunctioning.

sepfl-install.log :

 

Wed Mar  6 14:42:42 JST 2019: Pre-check is successful

Wed Mar  6 14:42:42 JST 2019: GUI component installed successfully

CONFIG_RETPOLINE=y

Starting AP: symev already loaded.

symap: unable to load kernel support module (UNSUPPORTED-OS-rh-ES-6-2.6.32-754.el6-)

found symev-rh-ES-6-2-6-32-431-el6-x86-64

Starting symcfgd: [60G[  [32m[1mOK[m  ]

 

symcfgd is started successfully.

Starting rtvscand: [60G[  [32m[1mOK[m  ]

 

rtvscand is started successfully.

Succeed to enable ap

AP status: Malfunctioning

Starting smcd: [60G[  [32m[1mOK[m  ]

 

smcd is started successfully.

/opt/Symantec/autoprotect ~/Downloads/14.2MP1

succeed to make link /lib/modules/2.6.32-754.el6.x86_64/kernel/drivers/char/symev_rh_ES_6_2_6_32_431_el6_x86_64.ko

symap is not loaded.

~/Downloads/14.2MP1

from 14.0.3897.1101, not upgrade from 1.0.14 or before.

Wed Mar  6 14:42:47 JST 2019: Installation completed

Wed Mar  6 14:42:47 JST 2019: =============================================================

Wed Mar  6 14:42:47 JST 2019: Daemon status:

Wed Mar  6 14:42:47 JST 2019: symcfgd [running]

Wed Mar  6 14:42:47 JST 2019: rtvscand [running]

Wed Mar  6 14:42:47 JST 2019: smcd [running]

Wed Mar  6 14:42:47 JST 2019: =============================================================

Wed Mar  6 14:42:47 JST 2019: Error: No drivers are loaded into kernel.

Wed Mar  6 14:42:47 JST 2019: =============================================================

Wed Mar  6 14:42:48 JST 2019: Auto-Protect starting

AP status: Malfunctioning in 1 time.

Wed Mar  6 14:42:49 JST 2019: Protection status:

Wed Mar  6 14:42:49 JST 2019: Definition: Waiting for update.

Wed Mar  6 14:42:49 JST 2019: AP: Malfunctioning

Wed Mar  6 14:42:49 JST 2019: =============================================================

Environment

Red Hat Enterprise Linux 6.5 (kernel is updated to 2.6.32-754)

 

Resolution

Symantec is aware of this issue and will update this document when a solution becomes available.  Please subscribe to this article to be notified of any updates

There are 2 possible work-arounds. 

• After upgrade OS kernel to 2.6.32-754, manually compile AP module then install SEP 14.2 MP1 over 14.0 RU1 MP1. This will result that auto-compile happens during install and the compiled symev/symap is loaded. For information on how to compile modules manually, see Manually compile Auto-Protect kernel modules for Endpoint Protection for Linux.
• After upgrade OS kernel to 2.6.32-754, uninstall existing SEPFL 14.0 RU1 MP1. Then reboot OS once (to unload symev module completely) and install SEPFL 14.2 MP1. This will result that pre-compiled kernel module for 2.6.32-754 is installed and symev/symap is loaded.