Older version of Symantec Critical System Protection (SCSP) agent exhibits compatibility issues with glibc
Multiple processes running on the Symantec Critical System Protection (SCSP) agent. After running command: ps -eaf | grep csp the output showed that multiple processes were running on the agent
The older version of CSP agent started to exhibit compatibility issues with glibc when the glibc version was updated to the current. www.symantec.com/business/support/index?page=content&id=TECH164892. This caused the SISIPS daemon to hang at startup and probably went unnoticed as it appears that it did not recover from this situation. This SCSP version was uninstalled and then SCSP 5.2 RU8 was installed. The older SISIPS daemon still showed up in the ps output – which explains the multiple processes symptoms. The 5.2 RU8 SISIPS daemon would exhibit connectivity issues. When the 5.2 RU8 Agent was noticed as offline at the console, the SISIPS daemon was not running on the system. The sisipsdaemon process seen in the output was from the earlier version of the CSP.
As expected, it appears that after rebooting the RH systems that showed the problem of stale IPS process (glibc issue), the stale process no longer appears and the new IPS daemon functions correctly and communicate with the server. One of the reasons why this issue occurred was because the systems had not been rebooted after the uninstall of 5.2.6 and fresh install of 5.2.8.
How Reboot addressed the issue:
1. When the system was recently rebooted, the stale daemon would not be started on system startup.
2. SCSP 5.2 RU8 has the fix for the glibc incompatibility issue.
3. After reboot 5.2 RU8 SISIPS daemon would start and connect with the SCSP server. It will appear online at the SCSP console.
Linux version 2.6.18-238.19.1.el5
build.date=Jul 15, 2011 14:02:59