Troubleshoot Linux Connector Compatibility on RHEL CentOS Oracle Linux

Available Languages

Download Options

  • PDF     (20.8 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (83.0 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (69.2 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 21, 2026
Document ID:215531

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes an incompatibility between Cisco Secure Endpoint Linux connector versions 1.12.4 and earlier.

Environment

On these platforms, the connector can appear to operate normally but does not detect File Rename and Network Events, Red Hat Enterprise Linux, CentOS, and Oracle Linux 7.8. Upgrade to connector version 1.12.5 or later to restore full event detection.

This issue applies to the connector versions, operating systems, and kernel versions described in the next sections.

Connector Version

The affected connector versions are:

  • 1.12.4 and earlier

Operating System

The affected operating systems are:

  • Red Hat Enterprise Linux 7.8
  • CentOS 7.8
  • Oracle Linux 7.8 (RHCK)

Note: Oracle Unbreakable Enterprise Kernel (UEK) is supported in connector versions 1.18.0 and later.

Kernel Version

The affected kernel versions are:

  • 3.10.0-1127.el7.x86_64 or later

Issue

On Red Hat Enterprise Linux, CentOS, and Oracle Linux 7.8 with kernel version 3.10.0-1127.el7.x86_64 or later, Cisco Secure Endpoint Linux connector versions 1.12.4 and earlier do not detect File Rename and Network Events.

Symptoms

Use these symptoms to confirm the issue:

  • In the Cisco Secure Endpoint Console, File Rename and Network Events are not detected by the connector and do not appear in Device Trajectory.
  • From a terminal window, run the command sudo cat /var/log/messages | grep "kernel: ampnetworkflow: <info> _msg_send_offset: peer disconnected". The command returns multiple results, indicating a failure in the ampnetworkflow kernel module used by the connector.
sudo cat /var/log/messages | grep "kernel: ampnetworkflow: <info> _msg_send_offset: peer disconnected"

Resolution

Connector Upgrade

Complete these steps to confirm the issue, upgrade the connector, and confirm the fix:

  1. Confirm the installed connector version on the endpoint. If the connector version is 1.12.4 or earlier, continue to the next step.
  2. Confirm the running kernel version:

    From a terminal window, run the command uname -r.

    uname -r

    The command returns 3.10.0-1127.el7.x86_64 or a later kernel version. If the command returns this version or later, continue to the next step.

  3. Upgrade the Cisco Secure Endpoint Linux connector to version 1.12.5 or later.
  4. After the upgrade, confirm that File Rename and Network Events are detected again and appear in Device Trajectory.
  5. Confirm that the ampnetworkflow error no longer appears in the system log: 
    sudo cat /var/log/messages | grep "kernel: ampnetworkflow: <info> _msg_send_offset: peer disconnected"

Related Content

Linux OS Compatibility

Linux User Guide

Revision History

Revision Publish Date Comments
3.0
21-Oct-2026
Recertification
2.0
17-Feb-2022
Added note on support for Oracle UEK
1.0
15-May-2020
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Alex Yakimenko
    Cisco

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products