F-Secure Elements Endpoint Detection and Response sensor installation failed and does not activate on Ubuntu without auditd package - F-Secure Community
<main> <article class="userContent"> <h3 data-version="4" data-article="000031593" data-id="issue">Issue:</h3> <p>F-Secure Elements Endpoint Detection and Response (EDR) sensor does not activate on Ubuntu. The state appears as "Waiting for connection" in the Elements Endpoint Protection portal and the Elements Endpoint Detection and Response portal. </p> <h3 data-id="resolution">Resolution:</h3> <p>Elements Endpoint Detection and Response functionality requires the <b>auditd</b> service to be installed and running on the system.<br><br>If Elements Endpoint Detection and Response sensor installation fails, an error like this will be printed to the system journal:<br></p><pre class="code codeBlock" spellcheck="false" tabindex="0"><br>"Sep 29 14:07:37 localhost fsbg[6692]: update installation failed: /sensor/1601277158"</pre> It is possible to fix the failed sensor installation by installing <b>auditd</b> and running the update command to let update system install the sensor automatically.<br><br>1. Run the command below to install auditd:<br>sudo apt-get install auditd<br><br>2. Fixing sensor installation:<br>sudo su<br><br><b>Note:</b> <i>sudo su will give the root shell, please execute the next command in that root shell</i><br><br>/opt/f-secure/baseguard/bin/update $(/opt/f-secure/baseguard/bin/update --list | grep sensor | cut -d ' ' -f 1) <p>Article no: 000031593</p> </article> </main>