[SOLVED] Crowdstrike Falcon Sensor on PVE 9 Host?

P

PALLBHV

New Member
Jan 14, 2026
3
0
1
Hello,

i just tried to install the falcon sensor on my pve 9 host.
It fails with some dependency errors:


Code: 
Unpacking falcon-sensor (7.38.0-19102) ...
dpkg: dependency problems prevent configuration of falcon-sensor:
 falcon-sensor depends on libnl1 | libnl-genl-3-200; however:
  Package libnl1 is not installed.
  Package libnl-genl-3-200 is not installed.

dpkg: error processing package falcon-sensor (--install):
 dependency problems - leaving unconfigured
Processing triggers for libc-bin (2.41-12+deb13u3) ...
Errors were encountered while processing:
 falcon-sensor

Is there a safe way to install the falcon sensor on a PVE 9.2.3+ Host?
Or should i do not do this because there a known issues installing falcon sensor on my hypervisor?

Best regards,
holger
 
Last edited:
PALLBHV said:
Hello,

i just tried to install the falcon sensor on my pve 9 host.
It fails with some dependency errors:


Code: 
Unpacking falcon-sensor (7.38.0-19102) ...
dpkg: dependency problems prevent configuration of falcon-sensor:
 falcon-sensor depends on libnl1 | libnl-genl-3-200; however:
  Package libnl1 is not installed.
  Package libnl-genl-3-200 is not installed.

dpkg: error processing package falcon-sensor (--install):
 dependency problems - leaving unconfigured
Processing triggers for libc-bin (2.41-12+deb13u3) ...
Errors were encountered while processing:
 falcon-sensor

Is there a safe way to install the falcon sensor on a PVE 9.2.3+ Host?
Click to expand...
How did you try to install it? At least libnl-genl-3-200 exists in debian Trixie.
 
PVE UI -> Console -> dpkg -i falcon-sensor_7.38.0-19102_amd64.deb

root@*******:/opt# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.5
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
 
Last edited:
You will need to follow up that dpkg command with an `apt-get --fix-broken install` for apt to pick up missing dependencies.

Are you following some kind of manual during that installation? I would expect that manual to cover that aspect.

I have no clue what that piece of software is going to do to your PVE cluster, but with the most prominent CrowdStrike-related news headlines in mind I'd be surprised if it was any good.
 
Last edited:
  • Like
Reactions: Johannes S
PALLBHV said:
Or should i do not do this because there a known issues installing falcon sensor on my hypervisor?
Click to expand...
Think of PVE as an appliance, especially if you have not installed it on a vanilla Debian base.

Can you install almost anything on Linux - yes. Have we seen Crowdstrike bring down quarter of the world IT - yes. Have they fixed _known_ bugs - yes.

As for installation errors, it would be better if you provided the entire output, including the command you run to initiate the installation and any preceding commands specified by the vendor.

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox
 
  • Like
Reactions: Johannes S and jtru
Hey guys. thank you for your reply.
I hab a typo with installing libnl-genl-3-200 ... My fault...
after installing it i can install the falcon sensor without problems.

thank you
 
Install deb via apt and take care of the dependencies with (path can also be relative)

Code: 
apt install /path/to/deb/file/install.deb

I don't know since when this works, but it does.
 
I'll leave here the installation references for the steps needed for proxmox 9.2.11 using falcon-sensor_7.40.0-19311_amd64.deb


Bash: 
> apt install libnl-genl-3-200

Installing:
  libnl-genl-3-200

Summary:
  Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 0
  Download size: 18.1 kB
  Space needed: 54.3 kB / 193 GB available

Get:1 http://deb.debian.org/debian trixie/main amd64 libnl-genl-3-200 amd64 3.7.0-2 [18.1 kB]
Fetched 18.1 kB in 0s (635 kB/s)
Selecting previously unselected package libnl-genl-3-200:amd64.
(Reading database ... 114499 files and directories currently installed.)
Preparing to unpack .../libnl-genl-3-200_3.7.0-2_amd64.deb ...
Unpacking libnl-genl-3-200:amd64 (3.7.0-2) ...
Setting up libnl-genl-3-200:amd64 (3.7.0-2) ...
Processing triggers for libc-bin (2.41-12+deb13u3) ...

> dpkg -i falcon-sensor_7.40.0-19311_amd64.deb

Selecting previously unselected package falcon-sensor.
(Reading database ... 114505 files and directories currently installed.)
Preparing to unpack falcon-sensor_7.40.0-19311_amd64.deb ...
Unpacking falcon-sensor (7.40.0-19311) ...
Setting up falcon-sensor (7.40.0-19311) ...
Created symlink '/etc/systemd/system/sysinit.target.wants/falcon-sensor.service' → '/usr/lib/systemd/system/falcon-sensor.service'.
Created symlink '/etc/systemd/system/multi-user.target.wants/falcon-sensor.service' → '/usr/lib/systemd/system/falcon-sensor.service'.
Processing triggers for libc-bin (2.41-12+deb13u3) ...

>  /opt/CrowdStrike/falconctl -s --cid=<company-id-code>

> systemctl status falcon-sensor
● falcon-sensor.service - CrowdStrike Falcon Sensor
     Loaded: loaded (/usr/lib/systemd/system/falcon-sensor.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-08-25 08:07:17 UTC; 15min ago
 Invocation: 5e6836abcasfdsfasdfe2c5aa85b1fbdb
    Process: 3795706 ExecStartPre=/opt/CrowdStrike/falconctl -g --cid (code=exited, status=0/SUCCESS)
    Process: 3795708 ExecStart=/opt/CrowdStrike/falcond (code=exited, status=0/SUCCESS)
   Main PID: 3795709 (falcond)
      Tasks: 86 (limit: 433820)
     Memory: 1.3G (peak: 1.4G)
        CPU: 3min 15.426s
     CGroup: /system.slice/falcon-sensor.service
             └─sensor.falcon
               ├─3795709 /opt/CrowdStrike/falcond
               └─3795710 falcon-sensor-bpf

Aug 25 08:11:46 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): Trying to resolve ts01-b.cloudsink.net:443
Aug 25 08:11:46 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): trying to connect to ts01-b.cloudsink.net:443
Aug 25 08:11:46 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): Connect to IPv4 54.67.48.56
Aug 25 08:11:46 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): Connected directly to ts01-b.cloudsink.net:443
Aug 25 08:11:47 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): ValidateCertificate: Certificate verified!
Aug 25 08:11:47 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): SSLSocket connected successfully to ts01-b.cloudsink.net:443
Aug 25 08:11:47 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): sock/ssl/proxy cnctd ok. First send to cloud.
Aug 25 08:11:47 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): CLOUDPROTO_ESTABLISHED. AgentId unchanged.
Aug 25 08:11:47 proxmox-01 falcon-sensor-bpf[3795710]: CrowdStrike(4): ConnectToCloud successful.
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back