Kernel driver unavailable

[kevchu3]

My collector pods are crashing since the kernel driver is unavailable. Per the documentation, this is expected but not ideal behavior [1].

I am running OpenShift 4.14.5 with RHCOS kernel version 5.14.0-284.43.1.el9_2.x86_64. Can we have this kernel version added to the supported list? [2]

A snippet of my collector logs:

[INFO    2023/12/01 17:09:18] Candidate drivers: 
[INFO    2023/12/01 17:09:18] collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o
[INFO    2023/12/01 17:09:18] Attempting to download collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o
[INFO    2023/12/01 17:09:18] Attempting to download kernel object from https://sensor.stackrox.svc:443/kernel-objects/2.7.0/collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o.gz
[INFO    2023/12/01 17:09:18] HTTP Request failed with error code 404
[WARNING 2023/12/01 17:12:13] Attempted to download collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o.gz 36 time(s)
[WARNING 2023/12/01 17:12:13] Failed to download from collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o.gz
[WARNING 2023/12/01 17:12:13] Unable to download kernel object collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o to /module/collector-ebpf.o.gz
[WARNING 2023/12/01 17:12:13] No suitable kernel object downloaded for collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o
[ERROR   2023/12/01 17:12:13] Failed to initialize collector kernel components.
[INFO    2023/12/01 17:12:13] 
[INFO    2023/12/01 17:12:13] == Collector Startup Diagnostics: ==
[INFO    2023/12/01 17:12:13]  Connected to Sensor?       true
[INFO    2023/12/01 17:12:13]  Kernel driver candidates:
[INFO    2023/12/01 17:12:13]    collector-ebpf-5.14.0-284.43.1.el9_2.x86_64.o (unavailable)
[INFO    2023/12/01 17:12:13] ====================================
[INFO    2023/12/01 17:12:13] 
[FATAL   2023/12/01 17:12:13] Failed to initialize collector kernel components.

[1] https://docs.openshift.com/acs/4.3/troubleshooting/commonly-occurring-error-conditions.html#unavailability-of-the-kernel-driver_error-conditions
[2] https://github.com/stackrox/collector/blob/master/kernel-modules/KERNEL_VERSIONS

[erthalion]

Hi, @kevchu3

The kernel in question seem to be quite fresh, it takes a bit of time to prepare probes for new kernels. At the same time, you can try core_bpf collection method, which is an alternative that should work for most of the supported kernels, no matter how new they are.

[kevchu3]

@erthalion thank you, this all seems to be working now. I'll go ahead and close this issue.