EDR: Service Status Shows "Running kernel unsupported, cannot load CarbonBlack kernel module!" When Sensor Installed On A Supported Version Of Ubuntu
book
Article ID: 287307
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Service status via systemctl cbdaemon.service shows "Running kernel unsupported, cannot load CarbonBlack kernel module!" when sensor installed on a supported version of Ubuntu.
Sensor installed successfully and operating as expected.
Environment
EDR Sensor: 7.0.0 - 7.0.1
Ubuntu: All Supported Versions
Cause
The message "Running kernel unsupported, cannot load CarbonBlack kernel module!" is a misleading error. Ubuntu uses eBPF technology instead of the kernel module so not having a kernel module is the expected behavior.
Resolution
This issue will be resolved in the 7.0.2 version of the EDR sensor.
Additional Information
Both cbdaemon.service and cbebpfdaemon.service should be running as both of these services are in use for distributions supported by eBPF.