The K-TAP kernel module is still present after the uninstallation of S-TAP

If the K-TAP kernel module is still present after the uninstallation of S-TAP, manually remove it.

Symptoms

The K-TAP kernel module is still present after the uninstallation of S-TAP on a Solaris server.

Causes

The server did not restart properly to remove the K-TAP kernel module on Solaris servers.

Environment

Solaris

Diagnosing the problem

Check on the Solaris server by running both modinfo | grep ktap and ls -al /dev/*tap*.

Resolving the problem

Manually remove the K-TAP kernel with the following steps.

  1. Check that /etc/init.d/upguard is removed.
  2. Remove /kernel/drv/sparcv9/ktap* and /kernel/drv/ktap*.
  3. Run modinfo | grep ktap to get the name of the loaded driver.
  4. Then, run rem_drv<loaded driver>. For example: rem_drv ktap_36821.
  5. Remove /dev/ktap* and /dev/guard_ktap.
  6. Restart the server.
  7. Run modinfo | grep ktap to make sure that the driver is no longer loaded.
  8. Remove GIM and gsvr entries from /etc/inittab (if you are using GIM only).
  9. Manually clean up remaining files in /usr/local/guardium.