There have been instances where Linux EDR service (cwp.service) is unexpectedly put into the “Stopped” state, according to systemd. This occurs when a desired state system manager decides to run Auditd since our service conflicts with it.
ften occurs with customers running configuration management tools such as Puppet.
If you experience this issue, please replace the `cwp.service` file in /etc/systemd/system/multi-user.target.wants/ with the following contents:
Description=Red Canary Cloud Workload Protection Service
Once you’ve replaced this unit file, restart the sensor.