Linux MID Server fails to restart and remains down after auto-upgrade (Interactive authentication required)Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Linux MID Servers fail to restart and remain offline following an automatic upgrade. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server goes down during an auto-upgrade and does not recover. Manual attempts to start the MID server as root succeed, but the AutoUpgrade thread re-attempts the pending upgrade, stops the service, and fails to start it again. The upgrade logs show the process retrying to start the service multiple times before aborting with UpgradeStatus=rollback_failure. The following error is visible in the output when the upgrade script calls start.sh: Failed to start snc_mid_<mid_server_name>.service: Interactive authentication required. Secondary Symptom: The MID Server may report the following non-blocking warning: Reinstall Service verification was failed during MID Server upgrade. It is possible that a required service re-installation was skipped. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Releases Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server upgrade process runs under the miduser service account. After swapping in the new binaries, it calls start.sh, which issues a plain systemctl start against the service unit without sudo. On Linux hosts where PolicyKit (polkit) does not authorize the miduser to manage that systemd unit, the call is rejected with an interactive authentication prompt. If the Linux host uses a newer version of polkit, it may only support the JavaScript .rules format, meaning any legacy .pkla rules previously set up to grant this permission will be ignored. (Note: The secondary "Reinstall Service verification failed" error occurs because the miduser account does not have root privileges to overwrite the systemd service definition file in /etc/systemd/system/. Because the core binaries successfully upgrade and the service definition hasn't fundamentally changed, this specific warning is benign and will not impact functionality.) Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } To resolve this, you must terminate the stalled upgrade and create a properly formatted polkit rule. Run the following steps as root on the affected Linux MID Server host: Step 1: Terminate the stale upgrade process An abandoned upgrade JVM from the failed attempt may still be running. Find the process: ps -ef | grep upgrade_temp | grep -v grep Kill the listed PIDs (use kill -9 if they do not exit gracefully). Step 2: Remove ineffective legacy rules Remove any old, unsupported .pkla files that are being ignored by the system: rm -f /etc/polkit-1/localauthority/50-local.d/midserver.pkla rm -f /etc/polkit-1/rules.d/10-midserver.rules (if formatted incorrectly) Step 3: Create the new polkit rule Create a new rule using the supported JavaScript format. (Note: The 00- prefix is important as polkit evaluates rules in lexical order). Run the following to create the rule: cat > /etc/polkit-1/rules.d/00-snc-mid.rules << 'EOF' polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units") { var unit = action.lookup("unit"); if (unit && unit.indexOf("snc_mid_") == 0 && subject.user == "miduser") { return polkit.Result.YES; } } }); EOF Apply the correct permissions: chmod 644 /etc/polkit-1/rules.d/00-snc-mid.rules Restart polkit: systemctl restart polkit Step 4: Validate permissions Verify the service account can manage the service without sudo or passwords: sudo -u miduser -- systemctl stop snc_mid_<mid_server_name>.service sudo -u miduser -- systemctl start snc_mid_<mid_server_name>.service sudo -u miduser -- systemctl status snc_mid_<mid_server_name>.service Once these commands complete without a password prompt, you can allow the pending upgrade to run naturally, or trigger it directly from the MID Server record in ServiceNow.