Symantec has discovered a defect in the SCSP agent on HP-UX systems where the IDS agent would fail to start.
The cause for this problem is the corruption of the FileWatch.dat file that is used by the IDS agent. FileWatch.dat is present under <SCSP_install_directory>/IDS/bin. The IDS agent fails to start successfully in case of a corrupt FileWatch.dat file and crashes.
The fix for this issue is available in the SCSP 5.2 RU9 release. If a full upgrade is not possible, the SCSP 5.2 RU8 MP4 HF2 hotfix can be found here: <link to the hotfix 2 page>
If the hotfix cannot be applied, there is a workaround that could solve the issue.
To prevent FileWatch.dat from reappearing and causing IDS to not start again, it is advised to add the following line to the sisidsagent startup script. This line will remove FileWatch.dat every time before starting IDS.
In <SCSP_install_directory>/IDS/bin/sisidsagent file, under start_idsagent(): Add rm -f FileWatch.*
after the line: cd $IDSAGENT_HOME
Removing the FileWatch.dat would only slightly affect IDS functionality.
The fix for this issue is available in the SCSP 5.2 RU9 release.
If a full upgrade is not possible, the SCSP 5.2 RU8 MP4 HF2 hotfix can be found here: