Resolution
fact
VigilEnt Security Agent for Unix 5.0
fact
Unix Manager 5.0
symptom
Expert Checker hangs at 0/37 and never completes.
symptom
Expert Checker gets stuck and never finishes.
symptom
Error: 'Unable to load from xml buffer.'
symptom
Attempt to parse Unix event failed with Event ID 21315.
cause
Expert Checker works with SP1 only if the version of perl that NetIQ shipped could find Exporter.pm in a system directory.
cause
Event ID 21315 is caused by a race condition that resulted in the alert_agent sending the beginning of an alert with the end of the previous alert in the spool file separated with a null character. Hotfix 48066 allows the alert_agent to detecting this condition, which avoids the race condition.
fix
Both Expert Checker and the xml buffer issue are related to detectd. Both are addressed in Hotfix 48066, which is available on the NetIQ Support site at https://www.netiq.com/support/vsm/extended/hotfixes.asp. This hotfix is also known as VSAU 5.0.1.9.
VigilEnt Security Agent for Unix 5.0
fact
Unix Manager 5.0
symptom
Expert Checker hangs at 0/37 and never completes.
symptom
Expert Checker gets stuck and never finishes.
symptom
Error: 'Unable to load from xml buffer.'
symptom
Attempt to parse Unix event failed with Event ID 21315.
cause
Expert Checker works with SP1 only if the version of perl that NetIQ shipped could find Exporter.pm in a system directory.
cause
Event ID 21315 is caused by a race condition that resulted in the alert_agent sending the beginning of an alert with the end of the previous alert in the spool file separated with a null character. Hotfix 48066 allows the alert_agent to detecting this condition, which avoids the race condition.
fix
Both Expert Checker and the xml buffer issue are related to detectd. Both are addressed in Hotfix 48066, which is available on the NetIQ Support site at https://www.netiq.com/support/vsm/extended/hotfixes.asp. This hotfix is also known as VSAU 5.0.1.9.
Additional Information
Formerly known as NETIQKB48066