Carbon Black Cloud: No Event or Alert data for Linux Sensors installed via RPM/DPKG

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• No Event or Alert data is generated for Linux Sensors installed via RPM/DPKG
• cbagentd-install.log isn't created under /var/opt/carbonblack/psc/log/

Environment

• Carbon Black Linux Sensor: All Supported Versions
• Linux: All Supported Versions

Cause

Linux Sensors are not installed properly via RPM/DPKG

Resolution

For direct end user installs, VMware Carbon Black recommends using install.sh script as the preferred method of installig Linux Sensors and ensuring all modules are installed correctly

Additional Information

• install.sh is avaiable in Linux Sensor version 2.6.0 and above
• Please note that install.sh should not be used to upgrade sensors