Background

Patch installation on the SPLX server was successful. However, upon startup of SPLX services, it was discovered that the services were not running normally. Based on the given log snippets from the message log located in /var/log, the SPLX services did not start normally due to the missing /boot/System.map-2.6.32-696.20.1.el6.x86_64 file in the SPLX machine.

Below are the log snippets:

Jun 18 12:11:07 localhost splx_service: ERROR: Cannot open /boot/System.map-2.6.32-696.20.1.el6.x86_64.
  Jun 18 12:11:07 localhost splx_service: ERROR: Cannot open /boot/System.map-2.6.32-696.20.1.el6.x86_64.
  Jun 18 12:11:07 localhost splx_service: error: executing [/sbin/insmod /opt/TrendMicro/SProtectLinux/SPLX.module/splxmod.o splxmod_addr=0x0 splxmod_execve_addr=0x0 splxmod_ret_addr=0x0 splxmod_ia32_addr=0x0 splxmod_compat_do_execve_addr=0x0] failed
  Jun 18 12:11:07 localhost splx_service: error: splx kernel module can't be loaded.
  Jun 18 12:11:07 localhost splx_service: Kernel module can't be loaded.
  Jun 18 12:11:07 localhost splx_service: step: starting vsapiapp service.
  Jun 18 12:11:09 localhost splx_service: step: vsapiapp service started.
  Jun 18 12:11:09 CRS-APP2 splx_vsapiapp: [19825:19825] open(): SPLX device is not installed
  Jun 18 12:11:09 CRS-APP2 splx_vsapiapp: [19825:19825] Vsapiapp failed to run.
  Jun 18 12:11:09 localhost splx_service: ServerProtect for Linux core started with errors.
  Jun 18 12:11:09 localhost splx_service: error: splxcore service can't be started.
  Jun 18 12:11:09 localhost splx_service: step: starting splxhttpd service.
  Jun 18 12:11:09 localhost splx_service: step: starting splxhttpd service.
  Jun 18 12:11:09 localhost splx_service: ServerProtect for Linux httpd started.
  Jun 18 12:11:09 localhost splx_service: step: splxhttpd service started.
  Jun 18 12:11:09 localhost splx_service: ServerProtect for Linux started with errors  

Solution

To resolve the issue:

1. Log on to the SPLX machine.
2. Go to the /boot directory and check if the System.map-2.6.32-696.20.1.el6.x86_64 file exists by running the following commands:

   cd /boot
   ls –lrt System.map*

   You will find that the file does not exist.

3. Get a copy of System.map-2.6.32-696.20.1.el6.x86_64 from a working SPLX machine with the same version:
    

   You need to stop the SPLX services in the target working SPLX server before getting a copy of System.map-2.6.32-696.20.1.el6.x86_64. In copying the file from another server, you may use winscp.

   To stop the SPLX services:

   1. Log on to the SPLX machine via putty.
   2. Type the following command:

      /etc/init.d/splx stop

   3. Press Enter.
4. Paste the copied System.map-2.6.32-696.20.1.el6.x86_64 file in the /boot directory of the affected SPLX machine.
5. Start the SPLX services:
   1. Log on to the SPLX machine via putty.
   2. Type the following command:

      /etc/init.d/splx start

   3. Press Enter.

The SPLX services should now run normally.