Sensor Health Message Says "Event Collector Not Installed"

Issue

User sees one of the following health messages for the VMware Carbon Black EDR sensor installed on an endpoint running Linux:

Event Collector Not Installed

Event Source Not Connected

Environment

VMware Carbon Black EDR

VMware Carbon Black EDR sensor (Linux)

Resolution

Check to see if the sensor version that is installed is compatible with the Linux distribution and kernel version that is running on the endpoint.

Source: https://community.carbonblack.com/t5/Documentation-Downloads/CB-Response-Sensors-amp-CB-Protection-Agents-Linux/ta-p/40888

If the sensor is compatible, then check to see if the kernel header packages have been downloaded and installed for the affected endpoint.

CentOS/RHEL:

rpm -qa | grep kernel | grep devel

Ubuntu:

dpkg -l | grep headers

Use the following commands to install the header files:

CentOS/RHEL:

yum install kernel-devel

yum install kernel-headers

Ubuntu:

sudo apt install linux-headers-$(uname -r)

Restart the sensor service:

systemctl restart cbdaemon.service