You have installed Symantec Protection Engine (hereafter SPE) 7.0.x on a Linux host. When you stop symcscan, it does not stop gracefully but crashes.
- /etc/init.s/symcscan stop
- service symcscan stop
You may notice the following files left on the system:
- /hs_err_pid<sse or spe's pid>.log
- /tmp/.java_pid<sse or spe's pid>
- /core.<sse or spe's pid> if ulimit is set to be "unlimited"
This issue was addressed with SPE 7.0.3.
This crash is not known to be related to any serious problems per se, unless your system explicitly generates core with ulimit settings (ulimit -c unlimtied) and serial stop-time crashes deplete available hard disk space quickly.
Possible mitigation for hard disk depletion issue:
- Peirodically remove core files generated under /, confirming that there are hs_err_pid<PID>.log with matching core.<PID> under /.
- Stop SSE not with service command but with some customized shell script, which first saves SSE's PID, stops the service, and removes resulted core and left-over files right as soon as they are generated.
- Linux (32-bit and 64-bit)
- JRE 1.6 or 1.7
- SPE 7.0.0 up to SPE 7.0.2 (SSE5.2.5 up to SSE 5.2.14 included but EOSL-ed)
symcscan stop creates hs_err_pid<sse_pid>.log created on /
Rate this Article