VMware Carbon Black Cloud Linux Sensor 2.13.2 Release Notes

VMware Carbon Black Cloud 2.13.2 | 19 JUL 2022 | Build 2.13.2.1054252 Check for additions and updates to these release notes.

What's New

Purpose of this Release

The 2.13.2 Carbon Black Cloud Linux Sensor is considered a maintenance release with a focus on Resolved Issues.

Product Enhancements

VMWare Carbon Black Cloud Linux sensor 2.13.2 includes changes in the behavior of network connection events. The Linux sensor no longer reports connections in the flow of data. The sensor now reports network connections at connection time and in the initial process discovery. This improves the overall performance and accuracy of the connection information.

Minor OS updates are also included as part of this release for the following OS:

• Ubuntu 21.10, Ubuntu 22.04
• Oracle 8.5, Oracle 8.6
• RHEL 8.6
• Debian 11.3

Resolved Issues

This section lists defects that have been resolved in the 2.13.2 Carbon Black Cloud Linux Sensor.

• PSCLNX-10464: Fixed an issue where the system log was filling up with "Unexpected" log messages

• PSCLNX-10405, EA-21154: Fixed an issue where the UI was not being updated correctly after  downgrading from 2.13.1 to 2.11.3

  This fix also resolved an issue where unexpected error messages were being written to the /var/log/messages file. 

• PSCLNX-10199: Fixed an issue where 2.12.0 sensors could automatically go into bypass mode after installation

  This was due to 5.14 and above kernels not being supported on BPF probe.

• PSCLNX-10415: Fixed an issue with the 2.13.0/2.13.1 prevented the sensor from disabling

  Upgrade from 2.13.0 and 2.13.1 is still impacted. The current workaround is to restart the existing sensor prior to upgrading.

• PSCLNX-10417, EA-21135: Fixed an issue where systems with high event rates were seeing  a loss of events that were not  being reported to the backend

Known Issues

The following table lists the known issues and limitations present in the Carbon Black Cloud 2.13.2 Linux Sensor. Each item lists the sensor version when the issue was first reported. Issues are removed after they are resolved.

• PSCLNX-10216: Upgrading from sensor versions 2.7.1 and older can fail in some situations because the cbagentd service fails to stop (sensor version found: 2.13)

  The workaround is to uninstall the sensor and reinstall the latest version.

• PSCLNX-2710: The sensor does not support uninstall from the Carbon Black Cloud (sensor version found: 2.6.0)

  The sensor does not support uninstall from the Carbon Black Cloud. To uninstall, issue the following commands:

  • For CentOS, RHEL, SUSE, or Amazon Linux:

  rpm -e cb-psc-sensor

  • For Ubuntu:

  dpkg --purge cb-psc-sensor

  Note: The agent will still be listed in the Registered Devices list on the backend after running the command unless you choose Take Action > Uninstall.

• PSCLNX-9707: Software upgrade log messages are not handled gracefully with unsupported distributions (sensor version found: 2.12)