Skip to main content

Kernel module not running in Endpoint Detection and Response

Malwarebytes Endpoint Detection and Response endpoint is displaying the needs attention indicator Needs_Attention.png. Click the indicator to see the message. If you receive the following error message:

"EDR Kernel module is not running."

Then this is due to the following reasons:

  • Kernel module is not installed due to missing Dynamic Kernel Module Support (DKMS) or Kernel headers dependencies.
  • An unexpected crash or kernel driver malfunction.

Check the Endpoint Detection and Response logs in '/var/log/com.malwarebytes.edr.log' for detailed information. For information on generating logs, see Collect Malwarebytes Endpoint Agent diagnostic logs.

Check for kernel module errors

Run this command to see if the module is correctly installed on your system:

  • $ sudo modinfo mbedr_drv

Below are the possible outputs and resolutions:

Output Resolution

ERROR: Module mbedr_drv not found.

The kernel module has not been built on the system.
  1. Consult your distribution documentation for how to build a kernel module and install DKMS. For more information, see Add Linux endpoints in Malwarebytes Nebula.
  2. Install the correct version of the kernel headers for your kernel build.
    • Use '$uname -r' to get your current kernel version.
ERROR: could not get modinfo from 'mbedr_drv': No such file or directory
  1. Run this command to remove the DKMS build:
    • $ sudo dkms remove -m mbedr_drv/<EDR VERSION>
  2. If the error persists, use the following command:
    • $ sudo dkms remove mbedr_drv/<EDR VERSION> --all

EDR VERSION: The current Endpoint Detection & Response plugin version. To find this, see Agent Information in Malwarebytes Nebula 

Output:

filename: /lib/modules/XXXXX-generic/updates/dkms/mbedr_drv.ko
version: X.X.X
license: GPL
author: Malwarebytes
srcversion: ...
  1. The driver was installed correctly. Use this command to check if there was a crash or internal issue:
    • $ sudo dmesg
  2. Provide the output to Malwarebytes Support.

Signing a kernel module

Systems with Unified Extensible Firmware Interface (UEFI) and Secure Boot enabled may require kernel modules to be cryptographically signed by a key trusted through the kernel. To sign the mbedr_drv module:

  1. Create a sign key with OpenSSL.
    • openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=Descriptive common name/"
  2. Sign the module.
    • sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n mbedr_drv)
  3. Import the Machine Owner Key (MOK).
    • sudo mokutil --import MOK.der
  4. Reboot.
  5. Follow distribution documentation on enrolling MOK.

Related articles