Warning: Anti-Malware Engine has only Basic Functions

When a new Linux kernel version is released, Trend Micro releases a new kernel support package for the agent. If a computer's kernel version is not currently supported, then the Anti-Malware engine can provide only basic protection. Regular protection resumes when the agent receives the update to support the new kernel version. To prevent this problem, verify that the new kernel version is supported before you upgrade it.

Basic functions

(1) Predictive machine learning: Sometimes this might work if the agent can get the process image path, but it is not reliable and therefore not supported.

(2) Process image file exclusion: Changes to user-mode matching. Performance could be impacted.

(3) Container protection: The agent cannot protect runtime container workloads in this mode.

Reason IDs

If the agent is providing only basic protection and you want to restore full functionality, then you must resolve the cause. Steps vary by reason ID:

• Reason ID 7: No driver is available for the particular kernel version causes a driver offline error. To resolve this: Check if latest Kernel Support Package (KSP) is released for that particular kernel. File a case to request KSP support.
• Reason ID 11: The Trend Micro public key--on the system when SecureBoot is enabled--is missing, so loading the driver failed, which caused a driver offline error. To resolve this: Install the machine owner key.
• Reason ID 12: The Trend Micro public key--on the system when SecureBoot is enabled--is expired, so loading the driver failed, which caused a driver offline error. To resolve this: Install the machine owner key.
• Other reason IDs: Create a diagnostic package and contact support.

The reason ID is included in events forwarded to an external Syslog, SIEM server, or to Amazon SNS. It is also displayed in the event description for the agent (either Anti-Malware Engine Offline or Anti-Malware Engine with Basic Functions).