I've just set up a task on the ePO to deploy the engine to clients immediately. This task ran successfully against a test client at 6.13 pm, and I confirmed that the expected processes were running on the client. About 15 minutes later, I noticed that none of these processes were now running. I cannot find any log files on the client, nor messages on the ePO, that would explain this, except for the following:
- There was a message in the client's VSEL Apache error log stating that at 6.16 pm something (nailswebd?) had caught a SIGTERM, and was shutting down.
- The Client Events list for this client on the ePO shows the automatic deployment of HotFix HF872066, again at 6.16 pm. It states "Deployment/Update Successful".
- /var/log/messages had: "nails-scan-status: LogClient connect failed on /var/opt/NAI/LinuxShield/dev/nailslog fd=21 No such file or directory(2)", also at 6.16 pm. However, there's a release-notes kind of page somewhere on this site that says the absence of this file can be ignored.
I have manually restarted VSEL on the client, and it appears to be happy.
It is possible that this HotFix, or the act of deploying it, somehow killed VSEL. Is that a reasonable supposition? How should this be investigated further? I don't want to have to restart VSEL on every client every time a HotFix is deployed...
Moved provisionally to ePO for better support