Carbon Black Cloud: Linux Config_IKHeaders=m shows in results but sensor stays in bypass saying Kernel Headers are needed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Sensor stays in bypass saying Kernel Headers are needed while checking prerequisite for Linux install command:

cat /boot/config-$(uname -r) | grep CONFIG_IKHEADERS

results show:

Config_IKHeaders=m

Environment

• Carbon Black Cloud Linux Sensor: 2.10 and newer
• Kernels: Linux 4.4 Kernels and newer

Cause

Specific functionality is missing or corrupt.

Resolution

Install Devel Headers or reinstall Kernel Headers using this Guide.

Additional Information

Config_IKHeaders=m means the kernel module should be there.
If the sensor says it is in bypass because of the Kernel headers with the value Config_IKHeaders=m then they must be missing or corrupt.