Technical Tip: How to tell if a Linux Collector is in User Mode or Kernel Mode or Application Mode?

[kwernecke]

Description
This article describes how to tell if a Linux Collector is in User Mode or Kernel Mode or Application Mode.
Solution

Kernel/user space modes does not have visibility in UI yet but can be seen in Collector logs or on the device with the status command:

/opt/FortiEDRCollector/control.sh --status

Example output:

root@localhost ~]# /opt/FortiEDRCollector/control.sh --status

FortiEDR Service: Up

FortiEDR Driver: NONE - Running in User Space mode

FortiEDR Status: Running