CB Response: Why are there warning messages in Linux sensor log - unable to get process information for pid[]?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why do the sensor logs show a several warnings like 'LogCommonInfo -- unable to get process information for pid[]'?

Environment

• CB Response Sensor: All Versions
• Linux: All Supported Versions

Resolution

• This message appears when cbdaemon attempts to access information of a process that was started before the sensor.

Additional Information

• Processes that start before the sensor may appear in the UI as '(unknown)'