EDR Sensor: RHEL 6 Endpoints Upgrade to 7.x and Go Offline

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors upgrade to 7.x and then go offline - "Running kernel unsupported, cannot load CarbonBlack kernel module!"
• CentOS 6 endpoints are not upgraded

Environment

• EDR Server: 7.4.0, 7.4.1
• EDR Sensor: 6.x - 7.x
• Red Hat 6.x

Cause

A bug the OS validation causes Red Hat endpoints to still get upgraded - CB-34466

Resolution

• CB-34466 is fixed in server version 7.4.2
• As a workaround, move RHEL 6 sensors to a policy that does not allow automatic upgrade of Linux sensors

Additional Information

• EDR server 7.4.0 introduced logic to prevent upgrades of Enterprise Linux 6 environments to the 7.x sensor, which is incompatible. 
• EDR server versions below 7.4.0 will not prevent upgrades on any EL 6 environment
• EDR server versions 7.x are still supported on RHEL 6.x but 7.x sensors are not