search

CrowdStrike / Cloud-Azure

Discover for Cloud and Containers Azure
28 stars 23 forks source link

Incorrect instructions for installing Linux sensor using VM Application #38

Open dulfer opened 1 year ago

dulfer commented 1 year ago

The instructions for setting up the Azure Virtual Machine Application to deploy the CS Sensor on Linux [🔗link] mentions:

Make sure to keep some iteration of mv CrowdStrike-Falcon-Linux-Installer falcon-linux-install.sh in --install-command. Otherwise, the application will fail to install.

In this case, the --package-file-name parameter is not included in the example, and the file is downloaded as falcon-linux-install.sh.

The current code example causes the installation to fail and therefore should be updated with either

  1. removing mv CrowdStrike-Falcon-Linux-Installer falcon-linux-install.sh && from the install-command, or
  2. adding --package-file-name CrowdStrike-Falcon-Linux-Installer to the gallery-app version creation command

Using the current code example, installaton fails:

Error output in /var/lib/waagent/Microsoft.CPlat.Core.VMApplicationManagerLinux/CrowdStrike-Falcon-Linux-Installer/{version}:

$ cat ./stderr
mv: cannot stat 'CrowdStrike-Falcon-Linux-Installer': No such file or directory

After removing from the install-command, the output to stdout is:

$ cat ./stdout
Check if Falcon Sensor is running ...[ Not present ]  
Falcon Sensor Install  ... [ Ok ]  
Falcon Sensor Register ... [ Ok ]  
Falcon Sensor Restart  ... [ Ok ]  
Falcon Sensor installed successfully.