Is Endpoint Linux Agent a rebootless client?

Products

• Endpoint Protection

Issue/Introduction

Does SEP Linux Agent require a reboot?

1) Fresh Install                                      
2) Upgrade from 14.3 RU3 and later     
3) Uninstallation of 14.3 RU3 and later
4) Only Kmod update from older to a newer version 

Resolution

The SEP Linux agent does not require a reboot in any of the cases mentioned above as it's a rebootless client from 14.3 RU3 onwards.
A reboot is only necessary if the previous kmod fails to unload due to the issues outlined below. If the previous kmod unloads successfully, no reboot is needed for installation/uninstallation or upgrade.

sdcss_install.log shows sisevt unload validation failed.

10/13/24 11:31:42: install_kmod: unloading sisevt module (version 1.120) ...
Error -1: ioctl(): EVT unload validation failed
10/13/24 11:31:42: install_kmod: sisevtrm ret 255
sisevt 143360 1 - Live 0xffffffffc0b93000 (PE)
10/13/24 11:31:42: Unable to unload sisevt module (version 1.120) on upgrade 

> There could be several reasons for the sisevt driver to fail to unload.
1) Due to the linux system running another Security software that interferes with or blocks sisevt module.
2) Due to another process hooking into sisevt.
3) The current version can't be uninstalled: If the current version can't be uninstalled, the kernel extension may not unload.
4) Dependent services are still running: If the current agent won't stop, the kernel extension may not unload.
5) The kernel can't quiesce: The kernel may not be able to quiesce, which can prevent the kernel extension from unloading.
6) Due to other reasons.

The Linux kernel usually unloads modules if their module_exit function returns successfully. If some function from the module crashes, the kernel may be able to recover, but the module is locked in memory.