Hello!

This is a heads-up for folks who run CrowdStrike Falcon on Linux servers, and particularly on Linux servers that were provisioned some time ago. It's a problem that CrowdStrike does not plan on fixing, and so I wanted to let others know before it causes your machines to hang.

You should have CrowdStrike Falcon installed at path /opt/CrowdStrike/. In that directory, you probably have one file whose name begins with "KernelModuleArchive", and many files whose name begins with "KernelModuleArchiveExt". That's the problem.

CrowdStrike appends a version number to every executable & library file. It does a good job of cleaning up old versions of almost all of its files. Except for KernelModuleArchiveExt.

I first noticed this happening when a virtual machine (with a small /opt partition) filled up /opt, and the system stopped responding. Turns out, /opt/CrowdStrike had filled up with 18 different KernelModuleArchiveExt files.

What is the fix? Well, our CrowdStrike admins opened a ticket with CrowdStrike, and we were told:

* Yes, the KernelModuleArchiveExt files are not being cleaned up automatically. Other files are being cleaned up automatically, but not the KernelModuleArchiveExt files.

* Will CrowdStrike release an update that cleans up the KernelModuleArchiveExt files? No.

* Will you put it on your roadmap to implement in the future? No.

* So, what should we do? If you want to clean them up, do it yourself.

If your site uses CrowdStrike uninstall protection, you cannot clean them up yourself without first getting a "maintenance token" from your CrowdStrike admins. Otherwise, deleting all KernelModuleArchiveExt files and restarting the CrowdStrike Falcon sensor works (it goes out and downloads the KernelModuleArchiveExt that it needs). Personally, though, I don't think we should have to do this.

Since CrowdStrike refuses to fix this, I wanted to let folks know, so you can check your systems. If you discover that this problem also affects you, I encourage you to open your own support ticket with CrowdStrike.

Wikipedia: Ship of Thesus: Edit Analytics

Tron: Ares is so bad it makes you wish AI would hurry up and destroy Hollywood

Tell HN: CrowdStrike Falcon users, check for excess KernelModuleArchiveExt files

Salamander - Your Terminal's AI Agent, Now In Your Pocket

Edit Back in Windows

Show HN: An open-source starter kit for implementing OWASP ASVS 5.0

Picking an AI Code Reviewer

InferenceMAX – open-source Inference Frequent Benchmarking

Ask HN: Why aren’t leaky abstractions considered bad practice in mathematics?

Building the Reasoning Engine at Axiom

FM Synths Explained with Memes [video]

RFK Jr pushes fringe claim linking autism to circumcision

Administration begins layoffs of federal workers amid government shutdown

Gen Z protests brought about change in Nepal via social media

Soft Drink Consumption Linked to Depression Diagnosis in Women, Study Says

AI profiteering is now indistinguishable from trolling

MIT rejects political cooperation in exchange for university funding

We are open sourcing The Mathematical Universe

Ask HN: Can you recommend any website blocking apps for Android?

Start a Blog

Deloitte caught out using AI in $440k report [video]

Richard von Coudenhove-Kalergi. A re-reading for the future of Europe

Hardware AI Toy I worked on is available in stores

More than half of entrepreneurs are considering moving to a new country

MIT Rejects White House Offer for Special Funding Treatment

Ask HN: Gradations

Bose SoundTouch home theater systems regress into dumb speakers Feb. 18

Death to the spinner: event sourcing for reactive web apps – Chris May [video]

I built a translator for spatial thinking (because I can't interview in Python)

Build a Superscalar 8-Bit CPU (YouTube Playlist) [video]

Show HN: Git Stars – Discover Trending Open Source Projects

Comments