KB Article | Forcepoint Support

Notes & Warnings

Important If Filtering Service (EIMServer) is stopped on a machine where user traffic is directed, users will not be filtered. Filtering Service is stopped with the WebsenseAdmin script.

Problem Description

The Forcepoint Services need to be restarted.

Resolution

Forcepoint services are configured to start automatically. If a service fails to start properly, or if changes are made to any Forcepoint configuration files (config.xml, websense.ini, eimserver.ini and others), then services will need to be restarted. Steps available on this article:

Services on a Windows server
Note If WebsenseAdmin commands are not working as expected, or if using 7.5 or prior  see WebsenseAdmin command not working in command prompt for troubleshooting and alternatives.
To stop or start all Websense web security services on a Windows server:
  1. Open Command Prompt as administrator.
  2. Navigate to the \Websense\Web Security directory.
  3. To check the status of services, type websenseadmin status
  4. To stop services, type websenseadmin stop
  5. To start services, type websenseadmin start
  6. To restart services, type websenseadmin restart
When using the WebsenseAdmin script to stop and start services, most services on the machine are started or stopped in the correct order. The process may take anywhere between 2 to 15 minutes depending on system resources and responsiveness of the server.
Note The following error messages that may happen from command prompt during WebsenseAdmin:
  • “Could not be started:1” indicates the service is already started.
  • “Could not be stopped:-1” indicates the service is already stopped.
  • “Could not be started:<string of numbers/letters>”  may indicate the service is hanging while starting. Check the status of the service after a couple of minutes.
  • “Could not be stopped:<string of numbers/letters>”  may indicate the service is hanging while stopping. Check the status of the service after a couple of minutes.
To stop or start individual services on a Windows server:
Important some services have dependencies on other services to stop, start, or to properly function. For a list of the services in what order to stop and start, see WebsenseAdmin command not working in command prompt for most services, and Forcepoint Security Manager logon screen stopped responding for services specific to the Manager.
  1. Open Services via run command services.msc
  2. Locate Websense service.
  3. To stop,  right-click the service and select Stop.
  4. To start, right-click the service and select Start.
  5. To restart, right-click the service and select Restart.
For the other services not part of WebsenseAdmin or the Manager, they can be restarted in any order. All but Control Service are related to report generation. These include:
  • Websense Control Service
  • Websense Web Reporting Tools
  • Websense Reporter Scheduler
  • Websense Explorer Report Scheduler
  • Websense Information Service
Note if stopping Filtering Service, ensure the service has actually stopped. This is due to the Filtering Service having the potential to hang if in process of a database download or during a latency issue with User Service.
    1. Open Task Manager and go to the Services tab.
    2. Find Websense EIM Server, copy the 4-6 digit number next to the name which is the PID number.
    3. Open a Command Prompt as Administrator.
    4. Type taskkill /f /pid <PID-Number>
    5. This should stop the service. 
    Important Do not use the taskkill command to stop Websense Services that are not hanging while stopping as this can break the files.
     
    Services on a Linux server
    On Linux machines, there are 2 tools that can be used to stop and start daemons:
    • The WebsenseAdmin script starts, stops, and restarts all daemons on the machine for Web services.
    • The WebsenseDaemonControl script starts and stops individual daemons. This is only available for Web services and Network Agent.
    • The WCGAdmin script starts, stops, and restarts all daemons on the machine for Content Gateway.
    Note As root access is required, these steps are specifically for Software Content Gateway. For Appliances, see Services on Appliances
    To stop the Web services
    • To use the WebsenseAdmin script to start or stop all daemons:
      1. SSH to the C interface IP of the proxy.
      2. Login with the Root credentials.
      3. Type cd /opt/Websense
      4. To check the status of services, type ./WebsenseAdmin status
      5. To stop services, type ./WebsenseAdmin stop
      6. To start services, type ./WebsenseAdmin start
      7. To restart services, type ./WebsenseAdmin restart
    • To use the WebsenseDaemonControl script to start or stop a specific daemon:
      1. SSH to the C interface IP of the proxy.
      2. Login with the Root credentials.
      3. Type cd /opt/Websense
      4. Type ./WebsenseDaemonControl
    A list of installed components is displayed, showing whether each process is running or stopped.
    1. Type the letter associated with a component to start or stop the associated process.
    2. To refresh the list, type R.
    3. When you are finished, type Q or X to exit the tool.
    Note if stopping Filtering Service, ensure the service has actually stopped. This is due to the Filtering Service having the potential to hang if in process of a database download or during a latency issue with User Service.
    1. Type cd /opt/Websense/bin/
    2. Type pidof EIMServer
    3. Copy the 5-6 digit as this is the PID number.
    4. Type kill -9 <the PID number>
     
    Important Do not use the kill command to stop Websense Services that are not hanging while stopping as this can break the files.

    To stop the Content Gateway services
    • To use the WCGAdmin script to start or stop all Content Gateway services:
      1. SSH to the C interface IP of the proxy.
      2. Login with the Root credentials.
      3. Type cd /opt/WCG
      4. To check the status of services, type ./WCGAdmin status
      5. To stop services, type ./WCGAdmin stop
      6. To start services, type ./WCGAdmin start
      7. To restart services, type ./WCGAdmin restart
    • Content Gateway services generally are not stopped or started individually as they have dependencies. In the event that one of the Content Gateway services is stopped and will not start with ./WCGAdmin start, raise a case with Technical Support to troubleshoot the service in question.
    Services on Appliances (V-series, X-series and Virtual Appliance for Web and Email)
    For Appliances needing to restart a single service, or if Network Agent in v8.3-v8.5 will not start or stay running after following the steps below, raise a case with Technical Support as this requires root access.
     
    • Stopping and Starting Services in Forcepoint Security Appliance Manager (FSAM) (v8.3-v8.5)
    1. In a browser, navigate to https://<ip-address>:9443/cm where the IP is the Forcepoint Management server.
    2. Log in with the administrator credentials.
    3. Click on the Appliance IP for the affected appliance.
    4. On the left for the services, click the Cogwheel and select Stop.
    5. Return to the FSAM, click the Cogwheel and select Start.
    • Stopping and Starting Services in CLI (v8.3-v8.5)
    1. SSH to the C interface IP of the proxy.
    2. Login with the Admin credentials.
    3. Type: config
    4. Enter the Admin password again.
    5. To check the status of services in the CLI:
      • Type show web
      • Type show proxy
      • Type start network-agent
    6. To stop services in the CLI:
      • Type stop web
      • Type stop proxy
      • Type stop network-agent
    7. To start the service in CLI:
      • Type start web
      • Type start proxy
      • Type start network-agent
    • Stopping and Starting All services in Appliance Manager (V7.0-v8.2)
    1. In a browser, navigate to https://<ip-address>:9443/cm where the IP is the Forcepoint Management server.
    2. Log in with the administrator credentials.
    3. Click Appliances at the top of the screen.
    4. Click Sign On for the appliance in question.
    5. If the Sign On button is not configured:
      1. Go to https://<ip-address>:9447 where the IP is the C interface IP of the appliance.
      2. Admin login will be required when landing on the page.
    6. Under Status > General (the default first page) locate the services that need to be stopped by section.
    7. Click Stop Services in the corresponding area where services need to be stopped.
    8. Return to Status > General in Appliance Manager, click Start Services in the corresponding area where services need to be started.
     
    Services on multiple Appliances or servers
    When there are multiple Web servers or Appliances in the network, it is essential to identify where the policy source is located. The server or appliance with the policy source holds the central configuration database for policies and settings
    • To identify the policy source location from Appliance Manager, navigate to Configuration > Web Components and check the selection under Policy Source.
    • To identify the policy source location from CLI, type show appliance info
    Once the Policy Source is identified, this server or Appliance must be up and running before working with the other servers or Appliances in the deployment. This is especially important as the Policy services have a very specific order for stop and start that must be adhered to:
    • When starting Websense services, always start, in the order shown.
    1. Websense Policy Database
    2. Websense Policy Broker
    3. Websense Policy Server
    • When stopping Websense services, always end with the following services, in the order shown.
    1. Websense Policy Server
    2. Websense Policy Broker
    3. Websense Policy Database
    Note On Appliances, or when using WebsenseAdmin scripts, these services are automatically started in the correct order.
    • If services are running on separate machines, use the stop and start commands on each machine after confirming the Policy Source is running as expected.
    Important If using v8.3-v8.5 or higher with a SIEM solution, Event Message Broker has its own dependent services which must be started in a specific order. This order is covered with WebsenseAdmin scripts, though if logs stop flowing to SIEM, raise a case with Technical Support for assistance.
     

    Article Feedback



    Thank you for the feedback and comments.