SentinelOne on Windchill Servers

[borourke]

Our NASA recently put SentinelOne virus protection on our production and test/dev servers. We have experienced some random issues with our Oracle database and Java runtime VM crashes. We also notice when the VM crashes, it wipes out the shortcuts to the Windchill shell, as well as overwriting the windchill.exe file to 0 bytes. Here is an example of the Java runtime error:

#
# A fatal error has been detected by the Java Runtime Environment:
#
# Internal Error (safepoint.cpp:895), pid=2952, tid=13280
# fatal error: Deadlock in safepoint code. Should have called back to the VM before blocking.
#
# JRE version: OpenJDK Runtime Environment Corretto-11.0.19.7.1 (11.0.19+7) (build 11.0.19+7-LTS)
# Java VM: OpenJDK 64-Bit Server VM Corretto-11.0.19.7.1 (11.0.19+7-LTS, mixed mode, compressed oops, g1 gc, windows-amd64)
# Core dump will be written. Default location: e:\ptc\Windchill_12.1\Windchill\hs_err_pid2952.mdmp
#
# If you would like to submit a bug report, please visit:
# https://github.com/corretto/corretto-11/issues/
#

We just wondering if anyone in PTCland is using SentinelOne and has experienced similar issues. Many thanks!

[jbailey]

Seen it here (Also in NASA Land).

You need an S1 Exception for the install location. S1 injection into the Java process is causing runaway memory issue with tomcat and it kills the method server(s). We saw this issue randomly for a while and then it filled up the folder where the dumps were stored and killed Windchill.

https://www.ptc.com/en/support/article/CS393413?source=search.

I'll send you a teams message if you need more details

Jim B.

[borourke]

James,

Many thanks for your help. Will talk with our sysadmins today about this.