Oracle Retail Agent enters zombie state or hangs due to SELinux denials on Linux

Products

• CA Automic Workload Automation - Automation Engine
• CA Automic One Automation

Issue/Introduction

The Automic RA Oracle Retail agent (RMS) stops processing jobs after approximately two days of uptime. The following symptoms are observed:

• The agent process remains visible in the OS process list (ps -ef) but does not execute jobs.
• The process acts as a "zombie" or non-functional process.
• No error messages are recorded in the RA Agent log or Automation Engine logs.
• There are no visible memory or CPU spikes prior to the hang.
• Reverting to an older version (e.g., version 12) may temporarily resolve the issue if security contexts differ.

Environment

• Product: Automic Workload Automation
• Agent: RA Oracle Retail (RMS) 2.2.2+
• RA Core: 24.4.3+
• OS: Red Hat Enterprise Linux (RHEL) 8.x / 9.x
• Database: Oracle Retail 19c

Cause

This issue is caused by SELinux (Security-Enhanced Linux) policies. On modern Linux distributions, SELinux may silently block background activities (such as memory access or file append operations) that have not been explicitly permitted. Because this block occurs at the kernel level, the agent application is unable to catch the exception or write an error to its logs, resulting in a frozen or "zombie" state.

Resolution

Consult with a Linux Security Administrator (SELinux Admin) to review the environment's security policies. The following steps help provide the administrator with the diagnostic data needed to identify potential environmental blocks.

Step 1: Verify SELinux Interference

Temporarily switch SELinux to permissive mode to determine if the agent resumes normal operation.

bash

 

# Check current statusgetenforce
# Set to permissive modesetenforce 0

If the agent functions correctly in permissive mode, it indicates that current security policies are interfering with agent operations.

Step 2: Collect Diagnostic Logs

Collect the Access Vector Cache (AVC) denial logs while the agent is active or during a hang event. This data identifies the specific system calls being restricted by the OS.

bash

 

# Retrieve recent denial eventsausearch -m avc -ts recent

Step 3: Consult with SELinux Administrator

Provide the diagnostic logs from Step 2 to the Linux Security team for review. To ensure the agent operates correctly within the secured environment, the administrator may look into options such as:

• Analyzing the identified denials to determine which agent activities (e.g., Java execution) are being restricted.
• Creating custom policy modules to allow necessary background operations for the agent process.
• Adjusting security contexts for the agent installation directory using standard utilities like semanage fcontext or restorecon.