Incompatibility issue between Trellix EDR and Auditd for RHEL

[vtgt]

When installing Trellix EDR 4.1.0.2243 on Redhat Linux 7.9 we noticed that Auditd service crashes.
We were able to identify that Trellix EDR Trace feature is responsible for this crash.

According to the product documentation of Redhat the Auditd service only can forward events to one destination service.

With https://kcm.trellix.com/corporate/index?page=content&id=KB92460 a knowledge base article was already published that there is an incompatibility issue with ACC and Auditd.
Do we have the same issue with Trellix EDR Trace feature?

A confirmation of the product team is much appreciated.

[Pravas]

Hi @vtgt ,

As per KB92460 Trellix EDR is incompatible when ACC & Auditd are installed together.

The only work-around it to use either ACC or Auditd but not both.

Thanks

[vtgt]

Hi @Pravas 

We do not use ACC on RHEL but we are using Auditd for internal monitoring.

Now we have the issue that Trellix EDR does not collect any process activities on RHEL.

We are wondering whether Trellix EDR has the same issue with Auditd if this service is used for kernel monitoring?  

[Daveb3d]

What version of RHEL?  I think they latest release isn't yet supported.  

Edit:  You said 7.9.  I'm pretty sure it isn't supported until the next release.  I have the same issue there.