Data Domain : Boostfs mount hangs in RHEL

Symptoms:
DDBoostfs mount hangs in RHEL.

The only way to exit the hanging mount command is to press CTRL+C or to use a --timeout=XXX parameter in the mount command. 
Note: the timeout command instructs the OS how long to wait for the mount to complete before giving up.

The mount point never exits without the timeout option.   And then we're unable to run "df" on the mount point with error "Transport endpoint is not connected"

In the Linux /var/log/messages file we find kill signal 2 (CTRL+C) and signal 15 (from the timeout parameter).
Example:

mount.boostfs[173032]: Caught Signal 2
mount.boostfs[171752]: Caught Signal 15

There are no errors in the boostfs logs /opt/emc/boostfs/log/ddboostfs_0_0.log.   When the boostfs process is killed we see this in the boostfs log: "clnt_async_destroy: RPC_CANTRECV will fail all the pending jobs and close socket"

We proved that ddboost ports 111 and 2049 were opened between client & server.  This can be done using diagnostic tools such as: nc, telnet, curl, ddpconnckr or other.

Cause:
check for tainted kernel modules:

grep . /sys/module/*/taint

The output showed:

/sys/module/falcon_kal/taint:E
/sys/module/falcon_lsm_pinned_15907/taint:E
/sys/module/falcon_lsm_serviceable/taint:PE
/sys/module/twnotify/taint:OE

In the above output we can see tainted modules from falcon (Crownstrike) and tripwire.  Both are IDS intrusion detection systems

Solution:
We stopped tripwire using:

systemctl stop tripwire-axon-agent.service tw-eg-service.service

After stopping tripwire then boostfs was able to mount normally.

This proved that boostfs mounts successfully when tripwire was down & we have some tripwire configuration issue in Linux