EDR: Service Status Shows "Running kernel unsupported, cannot load CarbonBlack kernel module!" When Sensor Installed On A Supported Version Of Ubuntu

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Service status via systemctl cbdaemon.service shows "Running kernel unsupported, cannot load CarbonBlack kernel module!" when sensor installed on a supported version of Ubuntu.
• Sensor installed successfully and operating as expected.

Environment

• EDR Sensor: 7.0.0 - 7.0.1
• Ubuntu: All Supported Versions

Cause

The message "Running kernel unsupported, cannot load CarbonBlack kernel module!" is a misleading error. Ubuntu uses eBPF technology instead of the kernel module so not having a kernel module is the expected behavior.

Resolution

This issue will be resolved in the 7.0.2 version of the EDR sensor.

Additional Information

Both cbdaemon.service and cbebpfdaemon.service should be running as both of these services are in use for distributions supported by eBPF.