Manual uninstall instructions for a Data Center Security Unix agent
search cancel

Manual uninstall instructions for a Data Center Security Unix agent


Article ID: 211391


Updated On:


Data Center Security Server Advanced Data Center Security Monitoring Edition


DCS Unix agent install is corrupted and will not uninstall using the conventional way




Data Center Security Server Unix Agent: All releases


This happens when agent folders get removed or are not able to be accessed. For example, when the /symantec folder is manually removed, DCS agent corruption will occur and this manual uninstall method needs to be used to remove ALL components of the DCS Unix agent


Before using the manual removal process, please try the standard removal methods

DCS 6.9.2 and higher

Location: /usr/lib/symantec/
sh --uninstall ALL

 DCS 6.9.1 and lower

rpm -e sdcss-kmod
rpm -e sdcss
Reboot server


If the above fails please follow these steps to manually remove the agent from the server:

Manual Steps

  1. In the management console, set the policy for the agent to uninstall to the Null prevention policy. If the Linux agent is not communicating with the management console, disable the agent, and then continue with the uninstall.

  2. Stop and disable services with systemctl 
    systemctl stop sisidsagent.service
    systemctl disable sisidsagent.service
    systemctl stop sisipsagent.service
    systemctl disable sisipsagent.service
    systemctl stop sisipsutil.service
    systemctl disable sisipsutil.service
    systemctl stop sisamdagent.service
    systemctl disable sisamdagent.service
    systemctl stop sisipsdaemon
    systemctl stop sisipsutildaemon
    systemctl stop sisidsdaemon
    systemctl stop sisamddaemon
    systemctl disable sisipsdaemon
    systemctl disable sisipsutildaemon
    systemctl disable sisidsdaemon
    systemctl disable sisamddaemon

  3. Run the following command to get the PID for the DCS Agent services
    pgrep -U sisips -P1 -f sisipsdaemon
    pgrep -U sisips -P1 -f sisipsutildaemon
    pgrep -U root -P1 -f sisidsdaemon
    pgrep -U root -P1 -f sisamddaemon

  4. Stop the DCS Agent services using the PID from Step 2
    If the agent process is not running, continue with the next numbered step.
    If either agent process is running, run the following command to stop the agent process:
    kill -KILL <agent_PID>

  5. Folder Removal
    Please make sure that you have deleted below folders:
    rm -rf /opt/Symantec/sdcssagent/
    rmdir /opt/Symantec
    rm -rf /etc/sisips
    rm -f /etc/sisips.conf
    rm -f /etc/init.d/sisi?s*
    rm -f /etc/init.d/rc?.d/*sisi?s*
    rm -rf /etc/symantec/sis/
    rm -rf /var/log/sdcsslog/
    rm -f /etc/yum.repos.d/sdcss.repo
    rm -rf /var/log/sdcss-caflog
    rm -rf /usr/lib/symantec
    rm -f /etc/systemd/system/sisips-init.service
    rm -f /etc/systemd/system/sisips-nfsd.service
    rm -f /etc/systemd/system/sisevt-init.service
    rm -f /etc/systemd/system/sisap-init.service
    rm -f /etc/systemd/system/sisipsdaemon.service
    rm -f /etc/systemd/system/sisidsdaemon.service
    rm -f /etc/systemd/system/sisipsutildaemon.service
    rm -f /etc/systemd/system/sisamddaemon.service
    rm -f /usr/lib/systemd/system/sisipsdaemon.service
    rm -f /usr/lib/systemd/system/sisidsdaemon.service
    rm -f /usr/lib/systemd/system/sisipsutildaemon.service
    rm -f /usr/lib/systemd/system/sisamddaemon.service
    rm -f /etc/systemd/system/sisidsagent.service
    rm -f /etc/systemd/system/sisipsagent.service
    rm -f /etc/systemd/system/sisipsutil.service
    rm -f /etc/systemd/system/sisamdagent.service
    rm -f /etc/systemd/system/sisips-init.service
    rm -f /etc/systemd/system/sisips-nfsd.service
    rm -f /etc/systemd/system/sisevt-init.service
    rm -f /etc/systemd/system/sisap-init.service

  6. Clean up systemctl
    systemctl daemon-reload
    systemctl reset-failed

  7. Clean up entry from rpm DB (duplicates are by design here)
    rpm -e --justdb sdcss
    rpm -e --justdb sdcss-kmod
    rpm -e --justdb sdcss-scripts
    rpm -e --justdb sdcss-kmod
    rpm -e --justdb sdcss

  8. Verify that packages are removed
    rpm -qa | grep sdcss

  9. Type and run the following commands to remove the agent user and group:
    userdel sisips
    groupdel sisips

  10. Reboot the Machine

  11. After the above steps are followed there may be remaining traces of the DCS agent components. 
    In order to cleanly uninstall the DCS agent, you should install the agent again, then use the conventional uninstall method to remove all components.


Uninstalling DCS Agent from AIX Agents

  1. rpm -e sdcss (AIX does not have kmod packages to uninstall)