topic Re: Kernel Module is Disabled - Status STOPPED - help installing in Cortex XDR Discussions

Kernel Module is Disabled - Status STOPPED - help installing

PWCMSS — Fri, 12 Jul 2024 05:46:09 GMT

I followed the instructions on the website,and there was a problem

root@jordan-server:~/tmp# dpkg -i cortex-8.2.0.118335.deb

Selecting previously unselected package cortex-agent.

(Reading database ... 83347 files and directories currently installed.)

Preparing to unpack cortex-8.2.0.118335.deb ...

Active kernel LSM: lockdown,capability,landlock,yama,apparmor

[ 1] Checking prerequisites

Verifying Ubuntu 24 (dpkg) packages:

* openssl ... OK

* ca-certificates ... OK

Done

Unpacking cortex-agent (8.2.0.118335) ...

Setting up cortex-agent (8.2.0.118335) ...

Active kernel LSM: lockdown,capability,landlock,yama,apparmor

[ 1] Installing Cortex XDR [8.2.0.118335] at /opt/traps

Detected glibc v2.39 via getconf

Using system libraries

Done

[ 2] Creating runtime directory

Done

not a dynamic executable

[ 3] Verifying iptables prerequisite

Done

[ 4] Defining Cortex XDR local services (systemd)

Created symlink /etc/systemd/system/multi-user.target.wants/traps_pmd.service → /etc/systemd/system/traps_pmd.service.

Done

[ 5] Creating/Verifying Cortex XDR auxiliary user

Done

[ 6] Configuring connection to server

Done

[ 7] Starting Cortex XDR security services

Name PID User Status Command

pmd 3837 root Running /opt/traps/bin/pmd

clad N/A N/A STOPPED N/A

dypd N/A N/A STOPPED N/A

spmd N/A N/A STOPPED N/A

lted N/A N/A STOPPED N/A

pyxd N/A N/A STOPPED N/A

Done

root@jordan-server:/opt/traps/bin# ./cytool status
Agent version: 8.2.0.118335
Content version:

Bpf is Disabled Kernel Module is Disabled Fallback is Disabled
Bpf is Not Running Kernel Module is Not Loaded
Event collection current status is: according to policy

Facility Policy State
Event Collection Disabled Disabled
EDR Disabled Disabled
DSE Disabled Disabled
ECL Disabled Disabled
File Scan Disabled Disabled
File Prevalence Disabled Disabled
LTEE Disabled Disabled
---------------------
EDR Disk Quota Status
---------------------
Quota Status: Ok
Current Disk Usage (MB): 0.00
High Watermark (MB):200.00
Low Watermark (MB):160.00

Operational Status:
General : No Content Received
Anti Exploit : Functional
Anti Malware : Anti Malware Flow Is Async
EDR : Functional
DSE : Functional
Anti LPE : AntiLPE Is Async

Last Successful Check-In time (UTC): 1970-01-01T00:00:00Z
Last Successful Check-In time (local): 1970-01-01T00:00:00Z

PID USER STIME RSS TIME COMMAND
3837 root 02:53 97060 00:00:52 pmd

Cortex XDR server show that.

What went wrong, or was something not done?

kernel version: 6.8.0-38-generic

Re: Kernel Module is Disabled - Status STOPPED - help installing

jmazzeo — Fri, 12 Jul 2024 15:46:29 GMT

Hi @PWCMSS, thanks for reaching us using the Live Community.

I can see in the logs that this is an Ubuntu 24 distro. This is not supported at the moment, that's why the agent can't start the services.

Please check here the distros and kernel versions supported: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Linux-Kernel-Versions/Ubuntu-18-aarch64

It gets updated every time a new Content Update supports a new distro or kernel.

If this post answers your question, please mark it as the solution.

回复： Kernel Module is Disabled - Status STOPPED - help installing

PWCMSS — Sun, 14 Jul 2024 14:18:11 GMT

It does not seem to be a kernel version problem

回复： Kernel Module is Disabled - Status STOPPED - help installing

jmazzeo — Mon, 15 Jul 2024 12:54:08 GMT

The documentation recommends 8.5 agent for this kernel version as the minimal version:

Anyway, I'll recommend you to open a TAC case to have better log investigation with the support team.

回复： Kernel Module is Disabled - Status STOPPED - help installing

PWCMSS — Tue, 16 Jul 2024 01:31:31 GMT

My kernel core version is 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

refer to：https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Linux-Kernel-Versions/Ubuntu-22-x86_64