Mac Symantec Management Agent becomes unresponsive after upgrade from 8.6 to 8.8.1 Release

Products

• IT Management Suite

Issue/Introduction

After the Symantec Management Agent for UNIX, Linux and Mac upgrades from version 8.6.4061 to 8.8.2128, the Mac client stops communicating with the SMP Server (Symantec Management Platform or Notification Server (NS)) and never recovers. The install log reports a successful upgrade, but the agent process does not come back online / communicating back to the SMP Server.

The Agent install log shows a warning at the upgrade step where the old agent's background service is stopped, on machines migrating from Intel to Apple Silicon binaries:

Stopping Symantec Management Agent for UNIX, Linux and Mac
Warning: Expecting a LaunchDaemons path since the command was ran as root. Got LaunchAgents instead.
launchctl bootout is a recommended alternative.
Unload failed: 5: Input/output error
Try running launchctl bootout as root for richer errors.
Replace x86 files with arm64

 

Diagnostics

Symptom in the client log (aexclient_*.log or <hostname>-aex-client.log, under /opt/altiris/notification/nsagent/var/log on the client):

After the upgrade job runs and the old agent shuts down cleanly, the log shows a shutdown sequence, then repeats a single line indefinitely with a new process ID each time:

ERRO 2026-07-02 14:50:41.282 437 6140456960 NSManager > Failed to open connection to the NS Manager plug-in (class ID: Altiris.AeXNSManager): 2164785203, The agent is currently shutting down
ERRO 2026-07-02 14:50:41.503 437 8270434176 ClientScheduler > Failed to connect to the Client Scheduler plug-in: 2164785203, The agent is currently shutting down
ERRO 2026-07-02 14:50:41.508 437 8270434176 AWSTransport > Failed to establish connection to the comm plug-in (class Altiris.AeXClientTransport): 2164785203, The agent is currently shutting down
INFO 2026-07-02 14:50:47.182 376 8270434176 Monitor > Exit.
INFO 2026-07-02 14:52:10.668 32373 8270434176 BaseSDK > CurlGlobalInit: OpenSSL 'fips' and 'base' providers are loaded
INFO 2026-07-02 14:52:12.136 32440 8270434176 BaseSDK > CurlGlobalInit: OpenSSL 'fips' and 'base' providers are loaded
INFO 2026-07-02 14:52:12.308 32444 8270434176 BaseSDK > CurlGlobalInit: OpenSSL 'fips' and 'base' providers are loaded
INFO 2026-07-02 14:52:12.479 32448 8270434176 BaseSDK > CurlGlobalInit: OpenSSL 'fips' and 'base' providers are loaded

This line repeats every 150ms to 2 seconds, with an incrementing PID, for the rest of the log. No further startup, registration, or error entries appear.

Diagnostic step	Command / path	Expected result	Interpretation
Check for the plug-in manager binary	ls -la /opt/altiris/notification/nsagent/bin/aex-pluginmanager	File is present	If missing, this confirms the defect
Review install log	/opt/altiris/notification/nsagent/aex-nsclt-install.log	Upgrade reports success	A successful-looking install log does not rule this out — the binary can still be missing
Review client log for crash-loop pattern	/opt/altiris/notification/nsagent/var/log/aexclient_*.log	Normal startup and NS registration entries after the upgrade job	Repeating CurlGlobalInit lines only, with no further activity, confirms the crash loop
Check for crash reports	/Library/Logs/DiagnosticReports/ and ~/Library/Logs/DiagnosticReports/	Crash files named for the process, e.g. aex-clie_*.crash or .ips	Crash reports may not always be present even when the process is looping; absence does not rule out the issue

Environment

IT Management Suite (ITMS)
Symantec Management Agent for UNIX, Linux and Mac

Affected upgrade path: Any pre-8.7.1 agent version (confirmed: 8.6.4061) upgrading directly to 8.8.2128.
Not affected: Agents already on 8.7.1 or later before upgrading.

Cause

Known issue.
The agent binary responsible for plug-in loading, aex-pluginmanager, is missing from the client after the upgrade completes. Without this binary the new agent process cannot finish starting. It initializes OpenSSL, then exits and restarts in a tight loop, several times a second, indefinitely.

This is a known macOS-specific defect. The fix was built into agent version 8.7.1 but was not applied retroactively to direct upgrades that originate from a version earlier than 8.7.1. Any Mac agent upgrading directly from a pre-8.7.1 build to a later build (in this case 8.6.4061 → 8.8.2128) can hit this issue.

Detection rule:
Confirm whether /opt/altiris/notification/nsagent/bin/aex-pluginmanager is present on the client. If it is missing after an upgrade, this is the issue.

Resolution

This issue has been reported to our Broadcom Development team. A fix is scheduled for our ITMD 8.8.2 Release.

 

Support guidance

Two remediation approaches were tested or proposed during troubleshooting. They are listed in the order they were validated, with their current verification status. Confirm the detection rule above before applying any of these.

Workaround 1 — Registry version correction plus forced push reinstall (Preferred)

This was found to resolve the issue in testing after a plain push reinstall (with "Keep the current Symantec Management Agent settings if possible" unchecked) failed to fix an already-affected machine. That plain reinstall attempt logged an NS-side warning, Impossible to downgrade the Agent, and the agent did not start. The registry correction below was required in addition to the push.

Note: the original ULM 8.8.1 agent release version is 8.8.2126. If the customer has already installed the ULM 8.8.1 v1 point fix, the ULM agent version is 8.8.2128. The steps below assume the ULM 8.8.1 v1 point fix from KB CUMULATIVE POST ITMS 8.8.1 POINT FIXES is already installed.

The registry version correction (step 1–2 below) is only needed if the ULM 8.8.1 v1 point fix has already been installed and pushed. If the customer has not installed that point fix, skip the registry change and go directly to step 3.

1. On the ITMS server, open the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Agent for UNIX, Linux and Mac\

2. Change the version value from 8.8.2126 to 8.8.2128 so it matches the actual agent package version being pushed.
   
   
   
3. On the ITMS console, go to: Settings > Agents/Plug-ins > Symantec Management Agent > Settings > Agent Install > Install Agent for Linux and Mac tab.
4. Select the affected Mac machines, open the "installation settings", and confirm Keep the current Symantec Management Agent settings if possible is unchecked.
   
   
   
5. Run the push install.
6. Confirm the affected machines complete a full reinstall (not an upgrade) and that the agent starts and registers with the SMP Server.

If a machine remains broken after Workaround 1: manually run the agent bootstrap on the affected Mac. This was observed to bring a broken agent back online in testing:

cd /opt/altiris/notification/nsagent/
./aex-bootstrap-macosx

Refer for more details if needed: Cloud-Enabled Agent Installation Package for Mac Computer

Workaround 2 — Manually restore the missing binary (verified on affected machines, recommended for one-off remediation)

1. On a machine with access to the original 8.8.1 release (8.8.2126) agent package (or if you have already installed ULM 8.8.1 v1 pointfix which has version 8.8.2128), expand the package (we will use the use case that you have already installed ULM 8.8.1 v1 pointfix agent version from KB CUMULATIVE POST ITMS 8.8.1 POINT FIXES):

   pkgutil --expand-full /tmp/8.8.2128/AltirisAgent.pkg /tmp/expanded-8.8.2128

2. Copy the missing binary to the affected client's agent bin folder:

   cp /tmp/expanded-8.8.2128/root.pkg/Payload/opt/altiris/notification/nsagent/bin/aex-pluginmanager /opt/altiris/notification/nsagent/bin/aex-pluginmanager

3. Restart the agent:

   sudo aex-helper agent stop
   sudo aex-helper agent start

4. Confirm the agent registers with the NS and the crash-loop log pattern stops.

This is a per-machine manual fix. It does not scale well to large numbers of affected Macs without scripting.

Recovering internet-connected Macs already on Cloud-enabled Management (CEM)

Macs on agent version 8.8.1 that connect through CEM and are already unable to communicate because of this issue can typically be recovered with a reinstall, since the defect only triggers on the upgrade path, not on a reinstall of the same version.

1. On the SMP console, generate a fresh Mac CEM installation package so it reflects the current environment after the recent upgrade: Settings > Notification Server > Cloud-enabled Management > Setup > Cloud-enabled Management Setup > Symantec Management Agent Configuration tab > Generate and download Symantec Management Agent installation package
2. Specify the package parameters in the Cloud-enabled Agent Installation Package dialog and generate the package. See Generating and installing the Cloud-enabled Management offline package and Cloud-enabled agent installation package for Mac computer for package contents and parameter details.
3. Transfer the generated package to the affected Mac by a method other than a server push (email, physical media, or file share), since the machine cannot be reached over the internal network.
4. On the affected Mac, run the package's install script with the -reinstall flag:
   

   ./<CEMpackage_name>.sh -pwd <package password> -reinstall

   <CEMpackage_name> is the actual filename of the script contained in the generated archive; substitute the real filename.

5. Confirm the agent reconnects through the CEM gateway and registers with the SMP Server.