Error: sisap_uc_uevent: fp was DELETED while logging into Linux devices with Endpoint Protection installed

Products

• Endpoint Protection

Issue/Introduction

Users and admins are unable to access the Linux device with Symantec Endpoint Protection (SEP) installed.

There is a flood of following messages:

Error: sisap_uc_uevent: fp was DELETED

Cause

The AP module is not loaded as the device is using an unsupported kmod, leaving sisamddaemon in a stopped state. The cafagent service crashes when trying to start up while sisamddaemon is stopped, eventually leading to a flood of console messages, preventing logon.

Resolution

Ensure the kmods are updated on the device: Updating the kernel modules for the Symantec Linux Agent

SEP 14.3 RU5 has a fix to prevent CAFagent from being started when sisamddaemon is stopped.

Additional Information

CRE-9183