Users and admins are unable to access the Linux device with Symantec Endpoint Protection (SEP) installed.
There is a flood of following messages:
Error: sisap_uc_uevent: fp was DELETED
The AP module is not loaded as the device is using an unsupported kmod, leaving sisamddaemon in a stopped state. The cafagent service crashes when trying to start up while sisamddaemon is stopped, eventually leading to a flood of console messages, preventing logon.
Ensure the kmods are updated on the device: Updating the kernel modules for the Symantec Linux Agent
SEP 14.3 RU5 has a fix to prevent CAFagent from being started when sisamddaemon is stopped.
CRE-9183