'Shutdown Failed' Message During Uninstallation in /var/log/messages

Reproduce Steps:

1. Uninstall IBM ISS Protection Agent.
2. Check for the var/log/messages in the CPM, could see shutdown failed messages for few services.

Excerpts from /var/log/messages:
Jul 16 04:53:08 vips_1 issDaemon: issDaemon shutdown failed
Jul 16 04:53:08 vips_1 iss-rrdd: iss-rrdd shutdown failed
Jul 16 04:53:08 vips_1 httpd: httpd shutdown failed
Jul 16 04:53:08 vips_1 cbi appagent: Running Pre-uninstall command: bash /VIPS_common/crossbeam/apps/issprovg/buildosinst /VIPS_common/crossbeam/apps/issprovg 172.16.61.212 uninstall
Jul 16 04:53:09 vips_1 cbi appagent: Command output: Performing Pre-Uninstall Cleanup... Restoring services...
Jul 16 04:53:20 vips_1 issDaemon: issDaemon shutdown failed
Jul 16 04:53:27 vips_1 iss-rrdd: iss-rrdd shutdown failed
Jul 16 04:53:27 vips_1 kernel: UnRegisterNotification
Jul 16 04:53:34 vips_1 snmpd: snmpd shutdown failed
Jul 16 04:53:34 vips_1 snmptrapd: snmptrapd shutdown failed
Jul 16 04:53:37 vips_1 httpd: httpd shutdown failed

This is standard daemon behavior on Linux to display an error message if the daemon fails to stop even if it is failing to stop because it is already stopped.

The reason the warnings are seen is because the individual RPMs that install the services are attempting to stop the services on uninstall.

The following RPMs are stopping services on uninstall:

• RPM:service(s)
• httpd:httpd
• iss-csf:issDaemon
• iss-rpm-compare:ss-rrdd
• net-snmp:nmpd, snmptrapd

This means that these services get stopped several times:

1. Once for each service by the CBI (issDaemon, iss-rrdd, httpd) - we also disable the service to make sure if the VAP reboots the service will not start up.
2. We then try again to stop the services:
   • issDaemon, iss-rrdd, httpd, iss-spa to force any services that were unable to be stopped in #1.
   • Also includes iss-spa in case user has registered with SiteProtector.
3. RPMs try to stop services on removal

The error is actually a Linux error and it is really a warning that the service is already stopped not a true error.

---

If the above information does not resolve your issue, please contact IBM Security Systems Technical Support.