Linux server errors

InsightIDR Event Sources
1

Hello, does anyone know what causes the error below on rhel Linux 6.10 and some rhel Linux 8.2?
Any insight would be helpful.

Error- "agent.jobs.linux.ui_realtime, Job terminated unexpectedly*
Thanks

2

Hello Tracey,

This is likely caused by the fact that you have auditd enabled on these machines, or it is not set up in compatibility mode.

The agent requires the auditd service to be installed but disabled on Linux systems. If you are unable to disable the auditd service, you can follow the instructions linked below for enabling compatibility mode.

ā€“
Tony

1 Like
3

Hi, I set up compatibility mode, disable the auditd service, we also reboot the linux box, but the error is still showing intermittently.

4

We have same error we followed instruction to enable compatibility mode. Could you give some advice how to trace and debug effectively this problem?
We use to work with Oracle Linux 7.9

5

Iā€™m running OL 8.8 and 8.7, and I have auditd running and set to compatibility. I got that same error I just restarted the rapid7 agent ir_agent. Seems to be working great so far.

https://docs.rapid7.com/insight-agent/auditd-compatibility-mode-for-linux-assets/

6

Thank you for prompt answer. So it seems there is latency because I did restart but the error disappeared in 10 minutes.

Thank you in a lot.