3778182 - SAP processes killed by SentinelOne with Signal 9

Potential symptoms can be as follows - 

• SAP system won't start
• Processes are killed with SIGKILL (signal 9)
• SUM and the SAP Host Agent or the message server of the ASCS instance is terminating with code=killed, status=9/KILL
• Operating system services (e.g. sshd, lvm2, irqbalance, systemd-journald, rpcbind, ...) were killed 

OS Journal shows entries such as:

saphostagent.service: Main process exited, code=killed, status=9/KILL
saphostagent.service: Failed with result 'signal'.

/var/log/messages file shows entries such as:

Unable to lockf() the lock file /tmp/.sapstartsrv01_sapstartsrv.log, some other process already has a lock. (Error 11 Resource temporarily unavailable)
Unable to open trace file sapstartsrv.log. (Error 11 Resource temporarily unavailable)

Check for SIGKILL events:

Audit logging is configured to watch and search for SIGKILL events:

auditctl -a always,exit -F arch=b64 -S kill -F a1=9 -k sigkill_watch
auditctl -l | grep sigkill_watch
ausearch -k sigkill_watch

SIGKILL events triggered by sentinelone-agent are recorded in the audit log:

time->Thu Jun 25 21:47:45 2026
type=PROCTITLE msg=audit(1782404265.432:2540): proctitle="s1-agent"
type=SYSCALL msg=audit(1782404265.432:2540): arch=c000003e syscall=62 success=no exit=-3 a0=356f a1=9 a2=7f140dda609c a3=31 items=0 ppid=1319 pid=2062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="s1-agent" exe="/opt/sentinelone/bin/sentinelone-agent" key="sigkill_watch"

Note: do not forget to remove the sigkill_watch audit rule after the investigation:

auditctl -d always,exit -F arch=b64 -S kill -F a1=9 -k sigkill_watch

Linux

Linux, SentinelOne, SentinelAgent, saphostagent, SUM tool, SIGKILL (signal 9), status=9/KILL , KBA , BC-OP-LNX , Linux , Known Error