BESAgent does not stop

Usage and Config Platform
1

On my RHEL8 system, I am not able to stop the BESClient service (Agent version 11).
No log files are generated since the issue, even if service is up and running.

Process kill works but when service is started again no errors are displayed in the logs and log generation stops automatically after few seconds

Obviously, server’s last report time is not updated since this happened.

Verified /etc/hosts, attempted __BESData cleanup and multiple service restart attempts. UDP ports are unblocked too. No space issue on the system.

Any help/pointers are highly appreciated.

2

We are also running thousands of RHEL devices on BigFix Client version 11, and so far, we haven’t encountered this specific issue. However, if this is a widespread issue in your environment immediately open case with product support team, I recommend going through the following steps:

  1. Enable BESClient debug logging
  2. Validate the actionsite.afxm file, consider replacing it with a copy from a known healthy client to rule out corruption or mismatch.
  3. Check for stale locks or runtime files by running:
rm -f /var/run/BESClient/*
rm -f /var/lock/subsys/BESClient
  1. Verify if any endpoint protection or control mechanisms are applied that might interfere with the BESClient process.
  2. Ensure the BESClient process is running as root. If it’s not, there may be a permission or installation issue.
  3. Engage HCL Support if the issue persists after trying the above steps.

Additionally, I’ve come across cases where SELinux permissioning may impact BESClient behavior. While I don’t have deep experience with SELinux, it might be worth exploring this angle.

1 Like
3

Thanks @vk.khurava. Issue is not widespread yet.
We already opened HCL case, will keep this updated for the findings.

Steps 2 and 3 didn’t help. We do have antimalware, m checking if it’s the cause.

Thanks again.