EDR appliance enters Linux emergency mode