Description:
What do multiple SEOS daemons mean?
Solution:
There typically should be only one 'seosd' daemon running. However, another daemon will launch and the first will be killed if the seosd daemon becomes unresponsive for a length of time. This is usually indicative of a performance issue where seosd does not respond to seoswd in a set amount of time. These situations can be caused by either overly generic FILE rules or a single process which is repeatedly accessing the same file. A seosd trace of the behavior can indicate where the performance issue lies.
However, more often, seeing multiple daemons are the result of multiple instances of the seosd agent running, which may show up in the process list as a 'seagent SEOSD' process? This is the communications daemon, rather than seosd the database daemon. This can return multiple instances for legitimate reasons, due to multiple connections to the local seosd daemon via selang, a remote policy model, or other management tools. These processes end on their own after the session is finished.