pe_status_check fact has a bug

# grep -w ss /opt/puppetlabs/puppet/modules/pe_status_check/lib/facter/pe_status_check.rb
    result = Facter::Core::Execution.execute("ss -onp state established '( dport = :8143 )' ", { timeout: PEStatusCheck.facter_timeout })
    result = Facter::Core::Execution.execute("ss -onp state established '( dport = :8142 )' ", { timeout: PEStatusCheck.facter_timeout })

because it doesn't specify protocol. ss tries every one and generates SELinux denials What's interesting, other fact in the same module does it correctly

# grep -w ss /opt/puppetlabs/puppet/modules/pe_status_check/lib/facter/agent_status_check.rb
      socket_state = Facter::Core::Execution.execute("ss -tone state established '( dport = :8142 )' ", { timeout: PEStatusCheck.facter_timeout })

Just looking and it seems like this module is still marked as supported, even if it hasn't had an update in a while, so you should be able to file tickets about it. I'm trying to see if I can get a hold of somebody who might know why it's doing this.

yeah, I looked, the last change was back in February 2025

I do monitor that repo to look for MRs, but based on latest activity it doesn't seem a lot of folks have needed any changes recently.

Should be alarming for PE sales, imho

Doubt it's a sales-related issue, but it worries me more that nobody has needed changes recently on this module. Usually if a module is well-used we see some sort of bug reports coming in, or issues raised on the module. But maybe since it's PE and supported most folks just go through the ticket system so I don't see it on the open source repo.

Deployed on server with SELinux in enforcing mode (AL2023)

Engineering has created a ticket to track the issue, and I've added your contact name and customer info to help them know who to reach out to for more details. There are some open questions, but needs some data so I'll reach out via DM.