When the Spotfire Python service attempts to initialize, it spawns a "canary" engine as part of its health check. This engine tries to open a local network socket (e.g., port 62002) for internal communication. Antivirus software, such as Crowdstrike, may flag this behavior a Java process (Node Manager) spawning a Python process that immediately opens a socket as suspicious and terminate the Python/R process. This results in errors such as "Engine failed during initialization," "Took too long to establish the socket connection," and an exit code of -536870873 (0xE0434352), indicating the process was killed before it could communicate.

Python/R service log will show below error message

DEBUG 2026-01-31T13:18:41,197+0000 [pythonsrv-62002-pythonsrv-62002] topology.engine.AbstractEngineController: Sending shutdown command to the engine
DEBUG 2026-01-31T13:18:41,197+0000 [pythonsrv-62002-pythonsrv-62002] topology.engine.AbstractEngineController: Exception closing socket connections: Cannot invoke "java.net.Socket.isClosed()" because the return value of "com.tibco.spotfire.topology.engine.AbstractEngineController.getSocket()" is null
DEBUG 2026-01-31T13:18:41,197+0000 [pythonsrv-62002-pythonsrv-62002] topology.engine.AbstractEngineController: Deleted session directory C:\Windows\Temp\work\pythonsrv-62002: true
DEBUG 2026-01-31T13:18:41,197+0000 [pythonsrv-62002-pythonsrv-62002] topology.engine.AbstractEngineController: pythonsrv-62002 shutdown completed.
DEBUG 2026-01-31T13:18:41,197+0000 [pythonsrv-62002-pool-1] topology.engine.EngineControllerInitializer: pythonsrv-62002 was interrupted while attempting to establish socket connection
WARN 2026-01-31T13:18:41,205+0000 [EngineQueueHandler] topology.engine.EngineQueueHandler: There was a problem removing active engine.
INFO 2026-01-31T13:18:41,205+0000 [EngineQueueHandler] topology.engine.EngineQueueHandler: Destroyed pythonsrv-62002 in 7ms
FATAL 2026-01-31T13:18:41,205+0000 [main] topology.engine.EngineQueueHandler: Error while initialize, - The service canary engine failed.
com.tibco.spotfire.topology.exception.EngineException: The service canary engine failed.

All

Contact your antivirus team (e.g., CrowdStrike, SentinelOne, or Carbon Black) to add an exclusion for the Python executable path used by the Spotfire Python service.
Example Path: `E:\spotfire\nodemanager\14.6.0\nm\services\Python Service Windows-14.6.x\python\python.exe` (Please verify the exact path on your Node Manager hosting the Python/R services, as it may vary based on installation directory and version).

This article addresses the Spotfire Python/R service engine initialization failure, specifically when the "canary" engine cannot establish a socket connection, often caused by antivirus software terminating the process.

Doc: Tips for running antivirus software

• https://docs.tibco.com/pub/spotfire_server/latest/doc/html/TIB_sfire_server_tsas_admin_help/server/topics/tips_for_running_antivirus_software.html