Manual uninstall instructions for a Data Center Security Unix agent or Symantec Endpoint Protection Linux Agent

Products

• Data Center Security Server Advanced
• Data Center Security Monitoring Edition
• Endpoint Protection
• Endpoint Security
• Endpoint Security Complete

Issue/Introduction

DCS Unix/Linux or SEP Linux Agent install is corrupted and will not uninstall using the conventional way

 

 

Environment

Data Center Security Server Unix Agent: All releases
Symantec Endpoint Protection 14.3 RU4+

Cause

This happens when agent folders get removed or are not able to be accessed. For example, when the /symantec folder is manually removed, DCS agent corruption will occur and this manual uninstall method needs to be used to remove ALL components of the DCS Unix agent

Resolution

Before using the manual removal process, please try the standard removal methods

DCS 6.9.2 and higher / SEP 14.3 RU4 and higher

Location: /usr/lib/symantec/uninstall.sh
sh uninstall.sh --uninstall ALL

 DCS 6.9.1 and lower

rpm -e sdcss-kmod
rpm -e sdcss
Reboot server

 

If the above fails please follow these steps to manually remove the DCS Agent from the server, for SEP Linux Agents please contact technical support:

Manual Steps

1. In the management console, set the policy for the agent to uninstall to the Null prevention policy. If the Linux agent is not communicating with the management console, disable the agent, and then continue with the uninstall.
   
   
2. Stop and disable services with systemctl 
   systemctl stop sisidsagent.service
   systemctl disable sisidsagent.service
   systemctl stop sisipsagent.service
   systemctl disable sisipsagent.service
   systemctl stop sisipsutil.service
   systemctl disable sisipsutil.service
   systemctl stop sisamdagent.service
   systemctl disable sisamdagent.service
   systemctl stop sisipsdaemon
   systemctl stop sisipsutildaemon
   systemctl stop sisidsdaemon
   systemctl stop sisamddaemon
   systemctl disable sisipsdaemon
   systemctl disable sisipsutildaemon
   systemctl disable sisidsdaemon
   systemctl disable sisamddaemon
   
   
3. Run the following command to get the PID for the DCS Agent services
   pgrep -U sisips -P1 -f sisipsdaemon
   pgrep -U sisips -P1 -f sisipsutildaemon
   pgrep -U root -P1 -f sisidsdaemon
   pgrep -U root -P1 -f sisamddaemon
   
   
4. Stop the DCS Agent services using the PID from Step 2
   If the agent process is not running, continue with the next numbered step.
   If either agent process is running, run the following command to stop the agent process:
   kill -KILL <agent_PID>
   
   
5. Folder Removal
   Please make sure that you have deleted below folders:
   rm -rf /opt/Symantec/sdcssagent/
   rm -rf /etc/sisips
   rm -f /etc/sisips.conf
   rm -f /etc/init.d/sisi?s*
   rm -f /etc/init.d/rc?.d/*sisi?s*
   rm -rf /etc/symantec/sis/
   rm -rf /var/log/sdcsslog/
   rm -f /etc/yum.repos.d/sdcss.repo
   rm -rf /var/log/sdcss-caflog
   rm -rf /usr/lib/symantec
   rm -f /etc/systemd/system/sisips-init.service
   rm -f /etc/systemd/system/sisips-nfsd.service
   rm -f /etc/systemd/system/sisevt-init.service
   rm -f /etc/systemd/system/sisap-init.service
   rm -f /etc/systemd/system/sisipsdaemon.service
   rm -f /etc/systemd/system/sisidsdaemon.service
   rm -f /etc/systemd/system/sisipsutildaemon.service
   rm -f /etc/systemd/system/sisamddaemon.service
   rm -f /usr/lib/systemd/system/sisipsdaemon.service
   rm -f /usr/lib/systemd/system/sisidsdaemon.service
   rm -f /usr/lib/systemd/system/sisipsutildaemon.service
   rm -f /usr/lib/systemd/system/sisamddaemon.service
   rm -f /etc/systemd/system/sisidsagent.service
   rm -f /etc/systemd/system/sisipsagent.service
   rm -f /etc/systemd/system/sisipsutil.service
   rm -f /etc/systemd/system/sisamdagent.service
   rm -f /etc/systemd/system/sisips-init.service
   rm -f /etc/systemd/system/sisips-nfsd.service
   rm -f /etc/systemd/system/sisevt-init.service
   rm -f /etc/systemd/system/sisap-init.service
   
   
6. Clean up systemctl
systemctl daemon-reload
systemctl reset-failed


7. Clean up entry from rpm DB (duplicates are by design here)
   rpm -e --justdb sdcss
   rpm -e --justdb sdcss-kmod
   rpm -e --justdb sdcss-scripts
   rpm -e --justdb sdcss-kmod
   rpm -e --justdb sdcss
   
   
8. Verify that packages are removed
   rpm -qa | grep sdcss
   
   
9. Type and run the following commands to remove the agent user and group:
   userdel sisips
   groupdel sisips
   
   
10. Reboot the Machine
    
    
11. After the above steps are followed there may be remaining traces of the DCS agent components. 
    In order to cleanly uninstall the DCS agent, you should install the agent again, then use the conventional uninstall method to remove all components.

 

Uninstalling DCS Agent from AIX Agents

1. rpm -e sdcss (AIX does not have kmod packages to uninstall)