After upgrading from SEDR 4.10 to 4.11, the appliance does not start correctly

Products

• Endpoint Detection and Response
• Endpoint Detection and Response Hardware
• Endpoint Protection with Endpoint Detection and Response

Issue/Introduction

After upgrading the Symantec Endpoint Detection and Response (SEDR) S550 appliance from version 4.10 to 4.11, the services do not start correctly and only the maintenance page is displayed.  Additionally a review of the system_health_monitor.log shows entries similar to the following:

INFO  SHM - ASYNC_CHILD:STDOUT:Tue Jun 10 11:12:53 GMT 2025 atp.webhook5.exchange exchange is up and running [async_child.cpp:840]
INFO  SHM - ASYNC_CHILD:STDOUT:Tue Jun 10 11:12:54 GMT 2025 atp.microservice.settings.request.exchange exchange is up and running [async_child.cpp:840]
WARN  SHM - ASYNC_CHILD:child 19651 timeout [async_child.cpp:950]
INFO  SHM - ASYNC_CHILD:kill(19651, 9) [utils.cpp:445]
ERROR SHM - ASYNC_CHILD:child 19651 exited with signal 9 [utils.cpp:507]
ERROR SHM - ASYNC_CHILD:Service(microservice_host): after start failed, stopping the service [async_child.cpp:1588]
INFO  SHM - ASYNC_CHILD:microservice_host: before_stop successful [async_child.cpp:1748]
INFO  SHM - ASYNC_CHILD:STDOUT:/var/run/symantec/sgs-td/microservice_host.pid [async_child.cpp:840]
INFO  SHM - ASYNC_CHILD:STDOUT:microservice_host (19469) is running... [async_child.cpp:840]
INFO  SHM - ASYNC_CHILD:STDOUT:Stopping Symantec Endpoint Detection and Response - EDR Microservice:  [async_child.cpp:840]
INFO  SHM - ASYNC_CHILD:STDOUT: SUCCESS!  [async_child.cpp:840]
INFO  SHM - ASYNC_CHILD:STDOUT: [async_child.cpp:831]
INFO  SHM - ASYNC_CHILD:Child 28669 exited with status 0 [utils.cpp:503]
INFO  SHM - ASYNC_CHILD:kill(19469, 9) [utils.cpp:445]
INFO  SHM - ASYNC_CHILD:microservice_host:after stop successful [async_child.cpp:1767]
INFO  SHM - microservice_host:cache system event:Service microservice_host stopped [actions.cpp:186]
INFO  SHM - ASYNC_CHILD:service microservice_host stopped [async_child.cpp:1788]
WARN  SHM - after_start for service microservice_host duration was 1921942 milliseconds. [ElapsedTime.cpp:70]
WARN  SHM - Start for service microservice_host duration was 1923287 milliseconds. [ElapsedTime.cpp:70]
ERROR SHM - ASYNC_CHILD:service start failed [async_child.cpp:1678]

Environment

SEDR 4.11 installed on the S550 hardware appliance.

Cause

The microservice_host after start failed due to a time out, causing all SEDR services to be stopped.

Resolution

This issue is resolved in SEDR version 4.12.  Broadcom support recommends upgrading to version 4.12 to receive this fix along with many others. 

If you are unable to update to version 4.12 then please install atp-patch3-4.11.0-1.

Additional Information

Installing patches for the on-prem SEDR appliance