#3641 Issue closed: ERROR: fstatat(9, dsa_filter.ko): No such file or directory¶

Labels: documentation, won't fix / can't fix / obsolete

gdha opened issue at 2026-09-21 11:48:¶

The analyze_rear_log.py found an interesting error in one of our rear logs:

======================================================================
  ReaR Log Analyzer
======================================================================

  Log file: /var/log/rear/rear-hostname.log
  Size:     157.9 KB

----------------------------------------------------------------------
  RUN SUMMARY
----------------------------------------------------------------------
  ReaR version:  2.6
  Workflow:       unknown
  Start:         unknown
  Duration:      ? seconds
  Completed OK:  Yes

----------------------------------------------------------------------
  STAGE TIMINGS
----------------------------------------------------------------------
  init                    0s
  prep                    2s  ##
  layout/save            13s  #############
  rescue                  3s  ###
  build                  78s  ##################################################
  pack                   93s  ##################################################
  output                 27s  ###########################
  backup                642s  ##################################################

----------------------------------------------------------------------
  ERRORS FOUND
----------------------------------------------------------------------
  L659   [ERROR] ERROR: fstatat(9, dsa_filter.ko): No such file or directory
         depmod: ERROR: fstatat(9, dsa_filter_hook.ko): No such file or directory
  L660   [ERROR] ERROR: fstatat(9, dsa_filter_hook.ko): No such file or directory

The missing kernel modules are coming from the TrendMicro ds_agent package. What happened?

The ds_agent package was removed, but the kernel modules couldn't get removed as there was still a java component in the process list that wasn't killed by the removal process. Due to this the cleanup couldn't do its full job.

gdha commented at 2026-09-21 11:56:¶

How to get rid of these errors?

The cleanest solution is to schedule a reboot, but if that is not possible in a short notice then use the below procedure.

#-> rpm -q ds_agent
package ds_agent is not installed
#-> lsmod | grep dsa
dsa_filter           2277376  0
dsa_filter_hook        20480  1 dsa_filter
#-> ps ax | grep tm_
 276054 ?        Sl     0:14 /opt/ds_agent/netagent/tm_netagent --metrics-file /var/opt/ds_agent/netagent/metrics.json --log-folder /var/opt/ds_agent/netagent/logs --ptn-folder /opt/ds_agent/netagent/pattern --jat-folder /opt/ds_agent/netagent/java/jattach --jex-folder /var/opt/ds_agent/netagentjava --log-console=false --log-level 1 --tmCfg WyJTc2xMaW51eEphdmFCdWlsZEVuYWJsZWQiLCJKYXZhQXR0YWNoIiwiRGlzYWJsZURvY2tlckJQRiIsIlNzbEluYm91bmQiLCJTc2xPdXRib3VuZCJd
 276064 ?        Sl     2:03 /opt/ds_agent/netagent/tm_netagent --metrics-file /var/opt/ds_agent/netagent/metrics.json --log-folder /var/opt/ds_agent/netagent/logs --ptn-folder /opt/ds_agent/netagent/pattern --jat-folder /opt/ds_agent/netagent/java/jattach --jex-folder /var/opt/ds_agent/netagentjava --log-console=false --log-level 1 --tmCfg WyJTc2xMaW51eEphdmFCdWlsZEVuYWJsZWQiLCJKYXZhQXR0YWNoIiwiRGlzYWJsZURvY2tlckJQRiIsIlNzbEluYm91bmQiLCJTc2xPdXRib3VuZCJd

#-> kill -9 276064 276054
#-> ps ax|grep tm_

#-> rm -rf /var/opt/ds_agent
#-> rmmod -f dsa_filter
#-> lsmod | grep dsa
dsa_filter_hook        20480  0

#-> rmmod -f dsa_filter_hook
#-> lsmod | grep dsa
#-> ls -l /lib/modules/$(uname -r)/kernel/net/dsa_filter
total 4
lrwxrwxrwx 1 root 2015 61 Aug  3 08:51 dsa_filter_hook.ko -> /opt/ds_agent/5.14.0-687.17.1.el9_8.x86_64/dsa_filter_hook.ko
lrwxrwxrwx 1 root 2015 56 Aug  3 08:51 dsa_filter.ko -> /opt/ds_agent/5.14.0-687.17.1.el9_8.x86_64/dsa_filter.ko

## Note: the above two links are dead links as the modules were already removed by the "rpm -e" command.

#-> rm -f /lib/modules/$(uname -r)/kernel/net/dsa_filter/*
#-> rmdir /lib/modules/$(uname -r)/kernel/net/dsa_filter

ReaR is tracking the kernel modules found below /lib/modules/$(uname -r)/kernel/net/dsa_filter, therefore, when the unfound dsa_filter kernel module links are removed our problem with reporting a false positive is also gone.

---

[Export of Github issue for rear/rear.]