Symantec Endpoint Protection Linux Agent shows "Component is Malfunctioning" error message in the Symantec Endpoint Protection Manager console

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) Linux Agent shows "Component is Malfunctioning" error message in the Symantec Endpoint Protection Manager (SEPM) console:

 

Environment

SEP Linux Client/Agent

Cause

The "Component is Malfunctioning" error message for Symantec Endpoint Protection Linux Agents seen in the Symantec Endpoint Protection Manager console, can be caused by two issues:

• Lack of compatibility of the Auto-Protect module with the currently installed kernel
• Lack of definitions
• The system is in Secure Boot mode

Resolution

• Lack of compatibility with currently installed kernel

For SEP 14.3 MP1 and older clients, see: Manually compile Auto-Protect kernel modules for Endpoint Protection for Linux 

For SEP 14.3 RU1 and newer agents, see: Updating the kernel modules for Symantec Endpoint Protection Linux Agent or the Symantec Single Agent for Linux

 

• Lack of definitions

Investigate the LiveUpdate log for failure reasons:

For SEP 14.3 MP1 and older clients, see: /opt/Symantec/LiveUpdate/Logs/lux.log

For SEP 14.3 RU1 and newer agents, see: /opt/Symantec/sdcssagent/AMD/sef/Logs/lux.log

 

• The system is in Secure Boot mode

To verify that the system is in Secure Boot mode, please run the following command:

mokutil --sb-state

The output should show “Secure Boot enabled". If this is the case, follow the KB article below and the attached documentation to import the public key into MOK key store:

Configure a secure boot system with Symantec DCS or SEP Linux products