Warning: Activity Monitoring Engine has only Basic Functions

When a new Linux kernel version is released, Trend Micro releases a new kernel support package for the agent. If a computer's kernel version is not currently supported, then the Activity Monitoring engine can provide only basic protection. Regular protection resumes when the agent receives the update to support the new kernel version. To prevent this problem, verify that the new kernel version is supported before you upgrade it.

Basic functions

Module	Category	Feature name	Supported	Comment
Activity Monitoring	Telemetry	File Create Event	*	* No support in container
		File Open Event	*	* No support in container
		Process Create Event	✔
		Process Terminate Event	✔
		DNS Query Event	*
		Network Inbound Connection Event	✔
		Network Outbound Event	✔
	UDSO	Logging action for IP address, domain, file SHA-1, and file SHA-256	*	* Cannot log all DNS query events.
		Quarantine or block action for file SHA-1 and file SHA-256	✔
	Response	Remote Shell	✔
		File Collection	✔
		Custom Script	✔
		Network Isolation	✔
		Memory Dump	✔

Reason IDs

To restore full functionality when the agent is providing only basic protection, you must resolve the cause of the warning based on the reason ID:

• Reason ID 7:
  1. Determine if the latest Kernel Support Package (KSP) for that particular kernel is available.
  2. File a case to request KSP support.
• Other reason ID:
  1. Create a diagnostic package and logs
  2. Contact Trend Micro support

The reason ID is included in events forwarded to an external Syslog, SIEM server, or Amazon SNS. Also the event description for the Anti-Malware Engine Offline or Anti-Malware Engine with Basic Functions agent displays the reason ID.

Reason ID	Event reason	Description
7	Unavailable kernel version	No driver is available for the Linux kernel version. This causes a driver offline error.
8	Failed driver loading	Loading the driver (tmhook or bmhook) into the kernel failed. This causes a driver offline error.
9	Failed driver unloading	Unloading a driver from the kernel failed. This causes a driver offline error.
14	Configuration file disable driver	Agent is set to not load the driver by configuration INI file. This causes a driver offline state.
15	Policy disable driver	Agent is set to not load the driver by Deep Security Manager or Workload Security policy. This causes a driver offline state.