Health Check FailureId[862]: Unsupported Kernel Version Installed

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent generating Events with Health Check FailureId[862] similar to:

The currently running Linux kernel is supported and you are protected. But protection will be disabled if you reboot and run unsupported Linux Kernel. Failure ID[862]

 

Environment

• App Control Agent: All Supported Versions
• Linux Operating System: All Supported Versions

Cause

A routine Health Check has discovered the endpoint has multiple kernel versions installed, and one of them does not currently support the Agent version that is installed.

Resolution

As long as the end point is not booted into the unsupported kernel, this message can be ignored. Additionally, the following actions can be implemented/considered:

• Work with the OS vendor (ex: Red Hat) to either:
  • Manually clean up unused/outdated kernels
  • Reduce the number of kernel packages retained
• Create a Health Check Exclusion to suppress Events relating to FailureId[862]
  • This typically is not recommended as it may create a situation where the endpoint boots to a version that is not protected by the Agent.

Additional Information

• Agent Health Check Event Guide and Resources
• Where To Find Supported Operating Systems
• Managing Health Check Exclusions