SEOS_syscall will not load in CA PAM SC 14.0/PIM 14.X

Products

CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

After installing CA PAM SC to the adequate version for the OS running in the endpoint, kernel extensions are not loaded and the following error is logged in the console

[[email protected]]# SEOS_load
SEOS_load: Executing un/load exit file, /usr/seos/exits/LOAD/SEOS_load_int.always -pre
CA Privileged Access Manager Server Control seversion v14.10.0.1583 - Display module's version

Running under: Linux
SEOS_load: "Red Hat Enterprise Linux" Kernel: 3.10.0-1160.6.1.el7.x86_64
SEOS_load: /usr/seos/bin/SEOS_syscall.70-3100-862-RHELX86_64.MP.ko
CA Privileged Access Manager Server Control seversion v14.10.0.1583 - Display module's version

Running under: Linux

File name: /usr/seos/bin/SEOS_syscall
Version : 14.10.0.1583
Created : Feb 25 2021 18:36:11
OS info : Kernel: 3.10.0-862.el7.x86_64-RH75 _LINU
SHA : F7E39ADDE64CB4A9A192B9F5BF7F8D41D96485677E667091FD378526CF0EC016F4E141B9CCF234D69537A5EAD663EE61F48D43F3766E
MD5 : DE805E4FC4670F3D2E86546AB80DFA20
SEOS_load: dmesg:
SEOS_load: Executing un/load exit file, /usr/seos/exits/LOAD/SEOS_load_int.always -post
SEOS_load: SEOS_syscall WASN'T loaded

Besides that, the following error message appears in the messages file of the endpoint

Apr 14 11:26:55 xxxx kernel: insmod: page allocation failure: order:4, mode:0x40d0

Or a similar message indicating page allocation problems

Environment

CA ControlMinder, CA Privilege Identity Management, CA PAM SC, various versions

Cause

This may be caused by the failure to allocate memory pages due to highly fragmented memory.

To check if this is the case, please look for the DMA information following the error in the messages file of the system and look for information about memory pages. In this particular case, the 0x40d0 code indicates that there are no more 64K pages free, and in the messages file we would see an entry similar to the following

Apr 15 11:05:52 xxx kernel: Node 0 Normal: 33822*4kB (UEM) 3408*8kB (UE) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 162552kB

We can see in this case that the system has run out of all memory pages except for 4kB and 8 kB ones, and hence it will not be able to load the kernel module

Resolution

This is likely a transient solution due to fragmented memory. Rebooting the machine should clear the situation. However, if this occurs on a regular basis you may want to contact your systems administrator to understand why the server is allocating all its memory.