IBM Support

QRadar EDR (formerly ReaQta): Runtime exception on module load: libscap: bpf_load_program() err=13 event=filler/sys_empty with Linux Agent 0.70.0 after registering the endpoint

Troubleshooting


Problem

Linux Agent 0.70.0 version might return the error: "Runtime exception on module load: libscap: bpf_load_program() err=13 event=filler/sys_empty" while registering the endpoint

Symptom

Failed to start ReaQta-Hive Service
Unit keeperx.service has failed

Cause

The keeperx.service fails to start due to a compilation issue (clang 15 or onward)

Environment

Linux Distributions:

CentOS Stream 8, CentOS Stream 9, Red Hat Enterprise Linux 8, or Red Hat Enterprise Linux 9

Diagnosing The Problem

  1. Check the clang version installed. If the installed version is 15 or onward the compilation issue occurs

    dnf info clang 

    Example:
     

    Installed Packages
    Name: clang
    Version: 16.0.0

  2. Check the journalctl logs by typing the command: journalctl –xu keeperx, and look for the following messages:

    image-20230922144634-1​​

Resolving The Problem

1. Uninstall the LLVM-toolset

dnf remove llvm-toolset

2. Follow instructions reported for CentOS Stream 8, CentOS Stream 9, Red Hat Enterprise Linux 8, or Red Hat Enterprise Linux 9 

sudo dnf install llvm-toolset-14*

3. Uninstall and install the linux agent again

sudo rpm -e keeperx

sudo RQTPARAMS="https://<URL>; --gids <group_IDs> --proxy <proxy_URI>" rpm -i <installer>.rpm

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSVOEH","label":"IBM Security ReaQta"},"ARM Category":[{"code":"a8m3p000000hBSZAA2","label":"Agent-\u003EInstallation-\u003ELinux"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Product Synonym

ReaQta

Document Information

Modified date:
22 September 2023

UID

ibm17029971

Page Feedback