kernel: netlink: 'falcon-sensor': attribute type 1 has an invalid length.

Solution In Progress - Updated -

Issue

  • System hung suddnely and following kernel messages is seen:
falcon-sensor: warning: CrowdStrike(4): SSLSocket Disconnected from Cloud.
falcon-sensor: info: CrowdStrike(4): calling SSL_shutdown
falcon-sensor: info: CrowdStrike(4): SslConnect: xxxx.net:443
falcon-sensor: info: CrowdStrike(4): trying to connect to 123.123.98.46:9515
falcon-sensor: info: CrowdStrike(4): ProxyConnect: Connected successfully to "xxx.net:443" via proxy "123.123.98.46:9515"
falcon-sensor: info: CrowdStrike(4): ConnectWithProxy: Connected to "xxxx.net:443" via proxy "123.123.98.46:9515": 0
falcon-sensor: info: CrowdStrike(4): ValidateCertificate: Certificate verified!
falcon-sensor: info: CrowdStrike(4): SSLSocket connected successfully to xxxx.net:443
kernel: info: networkcontain_nf: removing...
kernel: warning: networkcontain_nf: BasicDebugHeapPrintStats
kernel: warning:     Allocs: 0
kernel: warning:     Frees:  0
kernel: warning:     Diff:   0
kernel: warning:     Failures:   0
kernel: warning: 
kernel: info: networkcontain_nf: removed
kernel: info: serviceable_lsm: removing...
kernel: info: serviceable_lsm: exiting
kernel: info: serviceable_lsm: exiting proc userspace access...
kernel: info: serviceable_lsm: exited proc userspace access
kernel: info: serviceable_lsm: exiting shared cpp...
:::
kernel: info: serviceable_lsm: initialization complete
kernel: err: ServiceableModuleInit_Deferred: 0
kernel: info: pinned_lsm[926]: load_serviceable_symbols...
kernel: info: pinned_lsm[926]: load_serviceable_symbols succeeded
kernel: info: pinned_lsm[926]: load_network_ops_symbols...
kernel: warning: netlink: 'falcon-sensor': attribute type 1 has an invalid length.
kernel: warning: netlink: 'falcon-sensor': attribute type 1 has an invalid length.
falcon-sensor: info: CrowdStrike(2): Registered with kernel
kernel: info: manual prevention is enabled
kernel: info: network telemetry is enabled
falcon-sensor: info: CrowdStrike(4): ConnectToCloud starts

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
    • 4.18.0-372.19.1.el8_6.x86_64
  • Module falcon-sensor package
    • falcon-sensor-6.22.0-11906.el8.x86_64
    • falcon-sensor-6.41.0-13804.el8.x86_64

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content