Symantec Endpoint Protection CAFAgent Crash: Fixing the basic_string::substr Error on Linux

Products

• Endpoint Protection

Issue/Introduction

After fresh installations or system updates, administrators may notice that the Symantec Common Agent Framework (cafagent) fails to stay active. Checking the system agent status reveals that while core modules and endpoint protection daemons are running normally, cafagent repeatedly crashes and reports a "not running" status.

Daemon status:
  cafagent             not running
  sisamdagent          running
  sisidsagent          running
  sisipsagent          running
  sisevtd              running

Module status:
  sisevt               loaded
  sisap                loaded

 

When reviewing the agent logs to diagnose the loop, the following recurring error pattern appears within /var/log/sdcss-caflog/cafagent.log:

Information | 745968 : Starting Symantec CAF Service.
Information | 745968 : Creating SEPM product service.
Error | 745968 : basic_string::substr: __pos (which is 1) > this->size() (which is 0)
Information | 745968 : Symantec CAF service stopped.

Cause

The error basic_string::substr: __pos (which is 1) > this->size() (which is 0)  indicates that the application is attempting to parse or manipulate a text string, but the string it received is entirely empty (length of 0).

When the cafagent service initializes, it attempts to read host operating system details from the standard /etc/os-release file. The service will crash with this specific exception under two conditions:

1. Strict Permission Restrictions: Hardened security policies or misconfigurations have restricted read access to the /etc/os-release file (e.g., set to 600), preventing the service from viewing its contents.

2. Empty File: The /etc/os-release file exists but contains no data, leading to a zero-size string when read by the daemon.

Resolution

To fix the crash, you must verify the state of the /etc/os-release file and adjust its permissions to allow standard system services to read it.

Log into the affected Linux machine as root or a user with sudo privileges and check the file permissions using the following command:

ls -l -L /etc/os-release

If the file is restricted, the output will look similar to this, showing that only the root user has access:

-rw-------. 1 root root 196 Jul 7 10:14 /etc/os-release

For standard Linux systems, /etc/os-release must be universally readable so that applications and deployment scripts can identify the underlying distribution.

Modify the permissions to 644 (Owner: Read/Write, Group: Read, Others: Read):

sudo chmod 644 /etc/os-release

Once the file permissions are updated, restart the Symantec agent. Verify that the agent is stable by executing your daemon status utility again:

Daemon status:
  cafagent             running

The cafagent should now successfully parse the system information and maintain a steady "running" status.