EDR: Sensors Installed on RHEL/CentOS 7.8 are Unable to Compile Module

[#1]

Environment

• EDR Sensor: 6.3.0 and Below
• Linux: RHEL/CentOS 
• Kernel 3.10.0-1127.el7.x86_64

Symptoms

Sensors Installed on RHEL/CentOS 7.8 are Unable to Compile Module

• "Event Collector Not Connected"
• High CPU as cbdaemon services search for cbsensor.ko

Cause

Unsupported kernel version

Resolution

• Upgrade to version 6.3.1. 
  • CB Response: What Repo Contains a Specific Linux Sensor Version?
  • [CB EDR Linux] Announcing 6.3.1 and Linux Sensor General Availability
• Stop the user service to avoid high CPU issues on 6.2.2 or lower versions

  sudo service cbdaemon stop

Additional Notes

•  3.10.0-1127.el7.x86_64 Kernel was released on March 31, 2020. 

Related Content

• CB Response: What Repo Contains a Specific Linux Sensor Version?
• [CB EDR Linux] Announcing 6.3.1 and Linux Sensor General Availability