Carbon Black Cloud: Linux Config_IKHeaders=m shows in results but sensor stays in bypass saying Kernel Headers are needed
search cancel

Carbon Black Cloud: Linux Config_IKHeaders=m shows in results but sensor stays in bypass saying Kernel Headers are needed

book

Article ID: 286261

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Sensor stays in bypass saying Kernel Headers are needed while checking prerequisite for Linux install command:

cat /boot/config-$(uname -r) | grep CONFIG_IKHEADERS

results show:

Config_IKHeaders=m

Environment

  • Carbon Black Cloud Linux Sensor: 2.10 and newer
  • Kernels:¬†Linux 4.4 Kernels and newer

Cause

Specific functionality is missing or corrupt.

Resolution

Install Devel Headers or reinstall Kernel Headers using this Guide.

Additional Information

Config_IKHeaders=m means the kernel module should be there.
If the sensor says it is in bypass because of the Kernel headers with the value Config_IKHeaders=m then they must be missing or corrupt.