Prior to installing the sensor, the underlying BPF implementation requires the Linux kernel headers for the active kernel to be installed.

To verify that headers are installed, run the following command:

cat /boot/config-$(uname -r) | grep CONFIG_IKHEADERS

A result of either CONFIG_IKHEADERS=m or CONFIG_IKHEADERS=y means that you do not need to install any headers for BPF.

You can check the running kernel version by running the following command: $ uname -r

Note: Secure Boot is not supported by the CBC Linux installer at this time because the kernel module is not signed. Before installation, disable Secure Boot or sign the kernel module using your preferred method. Attempting installation without doing the former will result in the sensor entering bypass mode upon installation.

For CentOS, RHEL, Oracle RHCK or Amazon Linux

  • To check whether the kernel headers are installed (any user can run this):

    $ yum list kernel-devel-$(uname -r)

  • To install the necessary kernel headers:

    $ sudo yum install -y kernel-devel-$(uname -r)

  • When properly installed, the required kernel headers are located under

    $ /usr/src/kernels/$(uname -r)/include/

If the kernel headers package cannot be found

Linux distributions regularly update the kernel package and might not keep the old kernel headers package in their package repos. If this happens, the easiest solution is to update the system to the latest kernel and then rerun the kernel headers install command.

To update the kernel to the latest version and install kernel headers, run the following commands (this requires a reboot):

$ sudo yum update kernel kernel-devel

$ reboot

For Oracle UEK

  • To check whether the kernel headers are installed (any user can run this):

    $ yum list kernel-uek-devel-$(uname -r)

  • To install the necessary kernel headers:

    $ sudo yum install -y kernel-uek-devel-$(uname -r)

  • When properly installed, the required kernel headers are located under

    $ /usr/src/kernels/$(uname -r)/include/

For SUSE or OpenSUSE

  • To check whether the kernel headers are installed (any user can run this):

    $ zypper se -s kernel-default-devel | grep $(uname -r | sed “s/-default//”) $ zypper se -s kernel-devel | grep $(uname -r | sed “s/-default//”)

  • The output should be like the following, where the i+ signifies that the package is installed. If the left-hand column is v or is blank, the package must be installed.

    $ i+ kernel-default-devel | package | 4.12.14-lp150.12.25.1 | x86_64 | openSUSE-Leap-15.0-Update

  • To install the necessary kernel headers:

    $ zypper install --oldpackage kernel-default-devel=$(uname -r | sed “s/-default//”)

    $ zypper install --oldpackage kernel-devel=$(uname -r | sed “s/-default//”)

  • When properly installed, the required kernel headers are located under

    $/usr/src/linux-$(uname -r) | sed “s/-default//”)/include/ | grep -f

For Debian

  • To check whether the kernel headers are installed (any user can run this):

    apt list linux-headers-$(uname -r)

  • To install the necessary kernel headers:

    sudo apt install linux-headers-$(uname -r)

  • When properly installed, the required kernel headers are located under

    /usr/src/linux-headers-/$(uname -r)/include/

For Ubuntu

  • To check whether the kernel headers are installed (any user can run this):

    apt list linux-headers-$(uname -r)

  • To install the necessary kernel headers:

    sudo apt install linux-headers-$(uname -r)

  • When properly installed, the required kernel headers are located under

    /usr/src/linux-headers-$(uname -r)/include/