EDR Linux Sensor Error /virtual/main.c:2058:25: error: no member named 'iov' in 'struct iov_iter'

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Linux Sensor Shows 50/100 health
• cbdaemon status displays the following error:  /virtual/main.c:2058:25: error: no member named 'iov' in 'struct iov_iter
• Sensor is registered but no events come into the server

Environment

• Linux Sensor: 7.2.X (Ubuntu)
• Ubuntu Kernel: 6.4.X and above
  
  
• Linux Sensor: 7.2.0 - 7.3.X (RHEL)
• RHEL Kernel: 5.14.X and above

Cause

Change in the Linux kernel causes the ebpf event collector not to function properly.

Resolution

Ubuntu:

• Resolved in the 7.3.0 Linux Sensor

RHEL:

• Resolving in the 7.4.0 Linux Sensor

Additional Information

RHEL 9.4 is not supported at this time.