Environment
- Carbon Black Cloud Linux sensor: 2.10.x and higher
- Linux: Kernel 4.4 and higher
Question
How do I install the required Linux Kernel Headers for Linux sensor 2.10.x and higher?
Answer
Additional Notes
- Prior to installing the sensor, the underlying BPF implementation requires the Linux 4.4 kernel headers for the active kernel to be installed. However, some lower kernels are still supported without BPF integration, for the full list, please see Linux Sensor Support.
- Kernel headers are required for both Endpoint Standard and Enterprise EDR functionality
- Kernel headers must remain present after install
- Should the kernel be updated, the kernel headers should be updated as well
- In cases where kernel headers cannot be found via public repo the install command will fail, and the headers may have been removed by the vendor. Consider updating the kernel or finding an alternative source of the kernel headers for manual installation.
Related Content
