Kernel Module is Disabled - Status STOPPED - help installing

[PWCMSS]

I followed the instructions on the website,and there was a problem

root@jordan-server:~/tmp# dpkg -i cortex-8.2.0.118335.deb 

Selecting previously unselected package cortex-agent.

(Reading database ... 83347 files and directories currently installed.)

Preparing to unpack cortex-8.2.0.118335.deb ...

Active kernel LSM: lockdown,capability,landlock,yama,apparmor

[ 1] Checking prerequisites

Verifying Ubuntu 24 (dpkg) packages:

  * openssl ... OK

  * ca-certificates ... OK

Done

Unpacking cortex-agent (8.2.0.118335) ...

Setting up cortex-agent (8.2.0.118335) ...

Active kernel LSM: lockdown,capability,landlock,yama,apparmor

[ 1] Installing Cortex XDR [8.2.0.118335] at /opt/traps

Detected glibc v2.39 via getconf

Using system libraries

Done

[ 2] Creating runtime directory

Done

not a dynamic executable

[ 3] Verifying iptables prerequisite

Done

[ 4] Defining Cortex XDR local services (systemd)

Created symlink /etc/systemd/system/multi-user.target.wants/traps_pmd.service → /etc/systemd/system/traps_pmd.service.

Done

[ 5] Creating/Verifying Cortex XDR auxiliary user

Done

[ 6] Configuring connection to server

Done

[ 7] Starting Cortex XDR security services

              Name       PID           User                Status Command

               pmd      3837           root               Running /opt/traps/bin/pmd

              clad       N/A            N/A               STOPPED N/A

              dypd       N/A            N/A               STOPPED N/A

              spmd       N/A            N/A               STOPPED N/A

              lted       N/A            N/A               STOPPED N/A

              pyxd       N/A            N/A               STOPPED N/A

Done

root@jordan-server:/opt/traps/bin# ./cytool status
Agent version: 8.2.0.118335
Content version:

Bpf is Disabled Kernel Module is Disabled Fallback is Disabled
Bpf is Not Running Kernel Module is Not Loaded
Event collection current status is: according to policy

Facility Policy State
Event Collection Disabled Disabled
EDR Disabled Disabled
DSE Disabled Disabled
ECL Disabled Disabled
File Scan Disabled Disabled
File Prevalence Disabled Disabled
LTEE Disabled Disabled
---------------------
EDR Disk Quota Status
---------------------
Quota Status: Ok
Current Disk Usage (MB): 0.00
High Watermark (MB):200.00
Low Watermark (MB):160.00

Operational Status:
General : No Content Received
Anti Exploit : Functional
Anti Malware : Anti Malware Flow Is Async
EDR : Functional
DSE : Functional
Anti LPE : AntiLPE Is Async

Last Successful Check-In time (UTC): 1970-01-01T00:00:00Z
Last Successful Check-In time (local): 1970-01-01T00:00:00Z

PID USER STIME RSS TIME COMMAND
3837 root 02:53 97060 00:00:52 pmd

Cortex XDR server show that.

What went wrong, or was something not done?

kernel version:  6.8.0-38-generic

 

[jmazzeo]

Hi @PWCMSS, thanks for reaching us using the Live Community.

I can see in the logs that this is an Ubuntu 24 distro. This is not supported at the moment, that's why the agent can't start the services.

Please check here the distros and kernel versions supported: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Linux-Kernel-Versions/Ubuntu-18-aarch64

It gets updated every time a new Content Update supports a new distro or kernel.

If this post answers your question, please mark it as the solution.

[PWCMSS]

It does not seem to be a kernel version problem

[jmazzeo]

The documentation recommends 8.5 agent for this kernel version as the minimal version: 

Anyway, I'll recommend you to open a TAC case to have better log investigation with the support team.

[PWCMSS]

My kernel core version is 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

refer to：https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Linux-Kernel-Versions/Ubuntu-22-x86_64