You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 6 Next »

Purpose of Knowledge Article:

This is a guide to check if CrowdStrike is running correctly on your system.

Resolution:

    • Using CrowdStrike Falcon Client v6.x or higher
      1. In the terminal, run sudo /Applications/Falcon.app/Contents/Resources/falconctl stats
      2. When asked for the password, type in your computer password
      3. The result should show at the beginning:
        Host: ts01-laggar-gcw.cloudsink.net
        Port: 443
        State: connected


    • macOS 10.15 (Catalina)
      1. In the terminal run kextstat | grep crowd
      2. When asked for the password, type in your computer password
      3. The result should show “com.crowdstrike.sensor”, this indicates extension is working correctly


    • macOS 11 and later
      1. In the terminal, run systemextensionsctl list
      2. When asked for the password, type in your computer password
      3. The result should look like this:
        1 extension(s)
        --- com.apple.system_extension.endpoint_security
        enabled active teamID bundleID (version) name [state]
        * * X9E956P446 com.crowdstrike.falcon.Agent (5.38/119.57) Agent [activated enabled]
    1. Open up a Command Prompt
    2. Run the command sc query csagent
      Note: you may need to run the command prompt as an administrator
    3. Ensure the result shows “STATE” is “RUNNING”
    • No labels

    Was this site useful for you? Do you have any feedback or suggestions? Please click here to send your comments about this FAQ to IT.