falcon-linux-sensor pre-start job failed because it can't find systemctl to restart the service

Products

• VMware Tanzu Application Service
• VMware Tanzu Application Service

Issue/Introduction

When using Crowdstrike v1.3 and other service broker tiles on Tanzu Application Service, the customer tried to remove the old aws broker v1.4.20 tile but delete-errand failed due to pre-start job falcon-linux-sensor failed. Apply change error message as below -

Task 1362980 | 04:41:52 | L executing pre-start: delete-errand/xxxxxxxx (0) (canary) (00:00:29)
                        L Error: Action Failed get_task: Task xxxxxxxx result: 1 of 2 pre-start scripts failed. Failed Jobs: falcon-linux-sensor. Successful Jobs: bosh-dns.

 

For further investigation, the customer re-ran the errand manually with keep-alive then ssh on the VM and found below error message in the /var/vcap/sys/log/falcon-linux-sensor/falcon-installer.log -

2024/10/03 05:41:09 Error restarting Falcon sensor service: Could not find systemctl: /usr/bin/systemctl

Environment

Crowdstrike v1.3 installed and Service broker tiles on Tanzu Application Service with stemcell light-bosh-aws-xen-hvm-ubuntu-xenial-go_agent-621.969.tgz.

Cause

The falcon sensor installation worked but just failed because it can't find systemctl to restart the service, however it's still installed.

Resolution

As a workaround, kindly re-ran the errand manually with the same vm, it will pass and succeed because falcon sensor was already installed. After that re-run the apply change of service broker tiles delete-errand from opsman UI.

Per OSS CrowdStrike's falcon-boshrelease issue #16 update, this is fixed in the installer and will be fixed in the next release.