EDR: Sensors Installed on RHEL/CentOS 7.8 are Unable to Compile Module

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Sensors Installed on RHEL/CentOS 7.8 are Unable to Compile Module

• "Event Collector Not Connected"
• High CPU as cbdaemon services search for cbsensor.ko

Environment

• EDR Sensor: 6.3.0 and Below
• Linux: RHEL/CentOS 
• Kernel 3.10.0-1127.el7.x86_64

Cause

Unsupported kernel version

Resolution

• Upgrade to version 6.3.1. 
  • CB Response: What Repo Contains a Specific Linux Sensor Version?
  • [CB EDR Linux] Announcing 6.3.1 and Linux Sensor General Availability
• Stop the user service to avoid high CPU issues on 6.2.2 or lower versions

  sudo service cbdaemon stop

Additional Information

•  3.10.0-1127.el7.x86_64 Kernel was released on March 31, 2020.