Linux v2.5.1

Version 2.5.1 is the current Linux file forwarder. There is one package per distribution family, and for the RHEL family one per major release. Match the package to the major release rather than to the kernel: the kernel column in the compatibility table below records what was tested, not a version you have to match.

Release notes: Linux Forwarder 2.5.1.

Which package should I download?

All six packages are 64-bit, and all six are for version 2.5.1.

What does 2.5.1 require?

Two prerequisites, and the first one is the reason most Linux deployments underdeliver when they are missed.

• auditd must be running for real-time events. The package installs without it and the service starts happily, so this fails quietly: the initial backscan still collects everything already on disk, but nothing created or changed afterwards is sighted. Coverage looks correct on day one and silently stops tracking the machine from then on. Confirm it with sudo systemctl status auditd before you install, or sudo service auditd status on RHEL 6.
• Outbound connectivity to Stairwell. Prove it from the network you are deploying into with the checks on Pre-Deployment Check.

eBPF is not supported in the Linux forwarder today. Support for it is in development.

Which distributions has 2.5.1 been tested on?

How do I confirm the install worked?

Start on the host, then move to the app.

systemctl status stairwell

Then, in this order:

1. The machine appears under Assets with a recent check-in. See Assets.
2. Sightings start arriving for it, which proves the intake path is in use rather than merely open.
3. The asset is in the environment you intended. See Environments.
4. Collection is tuned for these machines through their group's policy. See Asset Configuration.

Expect elevated disk reads while the forwarder works through the files already on the machine, and expect that to subside. If the service is running and nothing arrives, Linux Forwarder Troubleshooting starts with auditd and works outward.

What should I read next?

• Forwarder Downloads, for the current forwarder on the other platforms.
• Linux Forwarder Troubleshooting, for the unit, the configuration file, SELinux, and AppArmor.
• swell, if a Linux host cannot take an agent at all and you want to send files from it on a schedule instead.