Help Center/ Host Security Service/ FAQs/ Protection/ Protection Interrupted
Updated on 2025-01-07 GMT+08:00
View PDF
Share

Protection Interrupted

Symptom

On the Asset Management > Servers & Quota page of HSS, the protection status of a server is Protection interrupted.

Figure 1 Protection interrupted

Solution

Hover the cursor over the question mark icon (?) next to the Protection Interrupted status. Check the cause of the interruption.

  • The server is stopped, the agent communication is abnormal, or the agent has been uninstalled.
    • The server is stopped.

      If a server is stopped properly, and no exceptions occur after the server is restarted, its protection status will automatically restore to Protected.

    • The agent communication is abnormal or the agent has been uninstalled.

      In the Agent Status column, check the agent status. If the agent status is Offline or Uninstalled, the agent is abnormal. Rectify the fault by referring to How Do I Fix an Abnormal Agent?.

  • No-load agent

    If the agent is restarted 12 times within 30 minutes due to excessive server memory usage or other reasons, the agent enters the no-load state on the current day and will be restored to normal the next day. In no-load state, all protection functions of the agent are disabled. You can only upgrade or uninstall the agent on the console. For details about the server memory occupied by the agent, see Peak Memory Usage.

    For details about how to manually restore the agent status, see Restoring the Agent to Normal from the Silent or No-load State.

  • Silent agent
    The agent enters the silent state due to the following reasons:
    • If the available memory of a server is less than 50 MB, the agent will enter the silent state in about 3 minutes. The agent becomes normal only if the available memory exceeds 250 MB.
    • If the agent is restarted 17 times within an hour due to excessive server memory usage or other reasons, the agent enters the silent state on the current day and will be restored to normal the next day. For details about the server memory occupied by the agent, see Peak Memory Usage.

    In silent state, all protection functions of the agent are disabled. You cannot upgrade or uninstall the agent on the console.

    For details about how to manually restore the agent status, see Restoring the Agent to Normal from the Silent or No-load State.

Restoring the Agent to Normal from the Silent or No-load State

If the agent is silent due to insufficient server memory, you are advised to expand the server memory to ensure that the available server memory is greater than 250 MB. Then, the agent will be automatically restored to the normal state.

If the agent is in no-load or silent state due to frequent agent restarts, you can wait until the agent is automatically restored the next day. You can also perform the following operations to manually restore the agent to the normal state.

If you have enabled the self-protection policy, disable it before performing the following operations. For details, see Disabling HSS Self-Protection.

  1. Modify the conf/framework.conf file in the agent installation directory and change the mode after the colon (:) of run_mode to normal.
  2. Perform the following operations to delete the file that records the number of restart times.
    • Linux: Run the rm -f /usr/local/hostguard/run/restart.conf command.
    • Windows: Find C:\Program Files\HostGuard\run\restart.conf and delete it.
  3. Perform the following operations to restart the agent.
    • Linux: Run the /etc/init.d/hostguard restart command.
    • Windows:
      • The agent version is 4.0.17 or earlier.
        1. Log in to the server as user administrator.
        2. Open the Windows Task Manager, choose Services.
        3. Right-click Hostwatch and choose Stop. After the status changes to Stopped, go to Step 4.
        4. Right-click Hostguard and choose Stop.
        5. Right-click Hostwatch and choose Start.

          After Hostwatch is started, Hostguard is automatically started.

      • The agent version is 4.0.18 or later.
        1. Log in to the server as user administrator.
        2. Open the command-line interface (CLI). Run the following commands in sequence to stop the service:

          sc control hostwatch 198

          sc control hostguard 198

          As shown in the Figure 2, the sp_state.conf file is not generated on the server with self-protection enabled.

          Figure 2 Stopping the service
        3. Open the Windows Task Manager, choose Services.
        4. Right-click Hostwatch and choose Start.

          After Hostwatch is started, Hostguard is automatically started.

Parent topic: Protection