Uninstall of SEP Linux Agent is failing with "Operation not permitted"

Products

• Endpoint Security Complete

Issue/Introduction

Uninstallation of SEP Linux Agent is failing with a message indicating the operation is not permitted.  A review of the log referenced in the error reveals that the /tmp directory is full.  Reviewing the list of files in /tmp, you find a folder called sisipsinfo.<timestamp> and this folder is consuming the remainder of space in the /tmp directory.

Environment

Release : SEP Linux Agent 14.3 RU1 and higher

Cause

The sisipsinfo.<timestamp> folder is temporarily created by the Gather Agent Info (GAI) log collection tool.  A GAI is automatically executed when uninstalling SEP Linux Agent.  GAI will pull some logs from /var/logs including messages logs.  These messages logs can sometimes be very large.  If the /tmp directory size limit is reached during this process, it will cause both the GAI and uninstall to fail and the sisipsinfo.<timestamp> folder to be left in /tmp.

Resolution

There are two options for resolving this issue:

• Provide adequate /tmp directory space for GAI to run
• Prevent GAI from running during uninstall

 

Provide adequate /tmp directory space for GAI to run

1. Remove unnecessary files from /tmp directory to provide additional space.
2. Examine the contents of the sisipsinfo.<timestamp> directory and make note of what's consuming the majority of space. Make a determination if any of the messages files can be deleted or relocated.
3. Delete the sisipsinfo.<timestamp> directory from /tmp using the following command:  

• • rm -r /tmp/sisipsinfo*

 

• Note: If adequate space cannot be provided in /tmp to accommodate running GAI, you'll need to prevent GAI from running during the uninstallation.

 

Prevent GAI from running during uninstall

1. To prevent GAI from running during uninstall, run the following command prior to initiating the uninstall:

• • touch /etc/sisips/NoAgentInfo 

2. Initiate uninstall of SEP Linux Agent.