Lacework incident

Lacework agent on older kernels (e.g. 3.10, 3.12) may experience degraded performance with active package detection enabled

Major Resolved

Lacework experienced a major incident on March 1, 2024, lasting 20d 23h. The incident has been resolved; the full update timeline is below.

Started
Mar 01, 2024, 09:13 PM UTC
Resolved
Mar 22, 2024, 08:56 PM UTC
Duration
20d 23h
Detected by Pingoru
Mar 01, 2024, 09:13 PM UTC

Update timeline

  1. monitoring Mar 01, 2024, 09:16 PM UTC

    Customers impacted have reported the datacollector is locking deleted files, and on very busy environments the disk space usage is growing. Disabling active package detection will alleviate this issue. Prior to mitigation, Linux agent versions <= v6.11.0 and v6.12.0 contained an issue which could cause excessive use of disk space or file descriptors when CAA is enabled on kernel versions prior to v3.12. The issue is resolved in v6.11.2 and v6.12.2