Endpoint Protection Linux modules sisevt and sisap fail to load on RHEL7 after installation

Products

• Endpoint Protection

Issue/Introduction

 Endpoint Protection Linux modules sisevt and sisap fail to load on RHEL7

When running /status.sh

Daemon status:
cafagent running
sisamdagent running
sisidsagent running
sisipsagent running

Module status:
sisevt not loaded
sisap not loaded

 

Entries from Agent_install log:

stopAgent:Stop Agent daemons if running..
useradd: lock /etc/passwd.lock already used by PID 114901
useradd: cannot lock /etc/passwd; try again later.

08/11/21 12:24:11: ERROR: Unable to add the sisips user or group. If this is a NIS/NIS+ enabled
08/11/21 12:24:11: machine, please verify the user and group name "sisips" is unique, and retry
08/11/21 12:24:11: installation. If this problem persists, please contact Symantec customer
08/11/21 12:24:11: support for more information.
#<08/11/21 12:24:11>: Error 1 Adding sisips user or group - Adding sisips user or group
08/11/21 12:24:11: #--- Start kmod pre installation <pid=109253> -------
08/11/21 12:24:11: Starting installation of kmod package version: 10.0.1.979
08/11/21 12:24:12: Using response file /var/tmp/sdcss-agent.response
08/11/21 12:24:12: #--- Start kmod package post installation <pid=109260> -------
08/11/21 12:24:12: install_kmod.. querying previous driver versions
08/11/21 12:24:12: install_kmod.. running driver setup
08/11/21 12:24:15: install_kmod: No reboot required to load EVT driver (ver 1.54)
grep: /etc/sisips/sisap.reg: No such file or directory
grep: /etc/sisips/sisap.reg: No such file or directory
08/11/21 12:24:16: Pre-install KMOD version file missing, could not update correct KMOD release in sis-version.properties
08/11/21 12:24:16: Enabling IPS Driver for system start..
Created symlink from /etc/systemd/system/default.target.wants/sisips-nfsd.service to /etc/systemd/system/sisips-nfsd.service.
Created symlink from /etc/systemd/system/sysinit.target.wants/sisips-init.service to /etc/systemd/system/sisips-init.service.
Created symlink from /etc/systemd/system/sysinit.target.wants/sisevt-init.service to /etc/systemd/system/sisevt-init.service.
Created symlink from /etc/systemd/system/default.target.wants/sisap-init.service to /etc/systemd/system/sisap-init.service.
08/11/21 12:24:17: #--- Stop kmod package post installation <pid=109260> -------

Environment

Release : 14.3 RU2

Symantec Agent for Linux Version: 14.3.92.2000

Cause

This issue is observed because password or shadow file was not available during first few attempts of product installation.

       useradd: lock /etc/passwd.lock already used by PID 114901
       useradd: cannot lock /etc/passwd; try again later.
       ...
       useradd: lock /etc/shadow.lock already used by PID 114901
       useradd: cannot lock /etc/shadow; try again later.

Resolution

Uninstall and reinstall Symantec Endpoint Protection Linux agent  and verify modules are loading correctly using command /status.sh.