This article covers resource and system requirements for the SentinelOne Linux Agent, deployed on endpoints managed through Guardz.
The Linux Agent protects both servers and containerized workloads. For Kubernetes workloads specifically, Guardz recommends deploying the Container Agent instead.
Note: For older requirements, see Using the Legacy Linux Agent. The legacy Linux Agent is intended for RHEL 5.5–5.11 only. To deploy the legacy Linux Agent, contact your SentinelOne account manager first. It is not supported in FedRAMP environments.
Linux Agent minimum resource requirements
1 CPU core / 2 threads, dedicated to the Agent
800 MB RAM minimum, dedicated to the Agent
2 GB in
/opt/sentinelone(3 GB recommended)Instruction-supported CPU: SSE4_2
Note: Some virtual environments mask support for advanced CPU capabilities. Check your VM vendor documentation for details.
Linux x86 operating system requirements
The Linux Agent supports SELinux in permissive and enforcing modes, allowing administrators to define and enforce security policies that limit process actions on the system — useful for organizations with strict compliance requirements. To run SELinux in enforcing mode in a hardened environment, follow the instructions in Configuring the Agent for SELinux.
The Linux Agent is supported on Amazon Elastic Container Service (ECS) Anywhere when used with the CWS for Containers product. See Securing Hybrid Cloud Containerized Workloads in AWS ECS Anywhere with SentinelOne Singularity for details.
For Docker containers, the Agent only supports the overlay2 storage driver, which requires the CWS for Containers product. To monitor and protect containers, the OverlayFS filesystem used by the containers must be mounted on the host's filesystem at
/var/lib/docker/overlay/<container-id>/merged(the default Docker location). See the Docker documentation on the OverlayFS storage driver for more information.The Linux Agent is compiled with a 64-bit kernel and libraries, and supports Intel x86_64-compatible architecture and x64 hardware.
The Linux Agent does not support:
32-bit architecture
CPU micro-architectures such as ppc64, x86_32, RISC, or MIPS
UNIX OS versions such as FreeBSD, AIX, or Solaris
On Oracle Linux, the Agent's active kernel hooks interfere with Ksplice's ability to modify kernel functions in memory at runtime, which causes the patch to fail. Disable the Agent before running Ksplice upgrades, then re-enable it once the patch completes.
The Linux Agent can be installed on desktops and servers of supported distributions (for example, Oracle 6.9 kernel-uek-4.1.12-61*).
Limitations of older kernels
Kernels earlier than 2.6 (build 2.6.32-358) — not supported.
Kernels earlier than 3.8 — Static AI and Reputation engines do not evaluate files on-write to disk (Full Disk Scan still functions as expected). File Modification and Network event types are not supported for telemetry collection.
Kernels earlier than 3.10 — containers are not supported, and the Agent is not compatible with eBPF.
Kernels earlier than 3.11 — Static AI cannot analyze files as they are written to a container; the Agent analyzes these files when they are executed instead.
A kernel bug in 4.19.0-6-amd64 and 4.19.0-8-amd64 can cause system freezes when the Agent is installed. Upgrade to a more recent kernel to resolve this.
The Agent does not support systems with Kernel Lockdown set to Confidentiality. For example, Fedora 31 Kernel 5.3.7's default Lockdown mode (Confidentiality) is not supported, while Fedora 31 Kernel 5.5.x's default (Integrity) is supported.
Login and logout event limitations
In Agent versions 25.3 and earlier, unsuccessful login events are not currently detected on AlmaLinux 10, CentOS Stream 9, Oracle Linux 10, RHEL 10, RHEL 9.8, and Rocky Linux 10.
In Agent versions 26.1 and earlier, login and logout events are not currently detected on Debian 13.
Linux CentOS, RHEL, Azure — Agent version compatibility
Linux Distro and Version | 26.1 | 25.4 | 25.3 | 25.2 | 25.1 | 24.3 |
AlmaLinux 10.2, 9.8 | Yes | Yes | No | No | No | No |
AlmaLinux 10.1, 10, 9.7, 9.6 | Yes | Yes | Yes | Yes | No | No |
AlmaLinux 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.3, 9.2 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.1, 9.0, 8.7, 8.6, 8.5, 8.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.12 | Yes | Yes | Yes | No | No | No |
Amazon Linux 2023.10, 2023.9, 2023.8 | Yes | Yes | Yes | Yes | No | No |
Amazon Linux 2023.7, 2023.6, 2023.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.3 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.1, 2023 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2, AMI 2018, AMI 2017 | Yes | Yes | Yes | Yes | Yes | Yes |
CentOS 8.5–8.0, 7.9–7.0, 6.10–6.4 | Yes | Yes | Yes | Yes | Yes | Yes |
CentOS Stream 9 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 10.2 | Yes | Yes | No | No | No | No |
RHEL 9.8 | Yes | Yes | Yes | No | No | No |
RHEL 10.1, 10, 9.7, 9.6 | Yes | Yes | Yes | Yes | No | No |
RHEL 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.3, 9.2, 8.9 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.1, 9.0, 8.7–8.0, 7.9–7.0, 6.10–6.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 10.2, 9.8 | Yes | Yes | No | No | No | No |
Rocky Linux 10.1, 10, 9.7, 9.6 | Yes | Yes | Yes | Yes | No | No |
Rocky Linux 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.3, 9.2 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.1, 9.0, 8.7, 8.6, 8.5, 8.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Note: On RHEL 8.1 only, Kernel version 4.18.0-147 may experience a soft lockup when the Agent uses eBPF.
Linux Debian, Ubuntu, SUSE — Agent version compatibility
Linux Distro and Version | 26.1 | 25.4 | 25.3 | 25.2 | 25.1 | 24.3 |
Debian 13.6 | Yes | No | No | No | No | No |
Debian 12.15 | Yes | Yes | No | No | No | No |
Debian 13.5–13.0, 12.14–12.11 | Yes | Yes | Yes | Yes | No | No |
Debian 12.10, 12.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.8, 12.7, 12.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.2, 12.1, 12 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.8, 11.7, 10.13 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.11, 11.10 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11, 10, 9, 8 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 26.04, 25.04 | Yes | No | No | No | No | No |
Ubuntu 24.04.4, 24.04.3 | Yes | Yes | Yes | No | No | No |
Ubuntu 24.04.2 | Yes | Yes | Yes | Yes | Yes | No |
Ubuntu 24.04.1, 22.04.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 20.04.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 22.04, 20.04, 18.04, 16.04, 14.04 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE Linux Enterprise Server 15 sp7 | Yes | Yes | Yes | Yes | No | No |
SUSE Linux Enterprise Server 15 sp6 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE Linux Enterprise Server 15 sp5 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE Linux Enterprise Server 11 sp4 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE Linux Enterprise Server 15.x, 12.x | Yes | Yes | Yes | Yes | Yes | Yes |
Scientific Linux 7, 6 | Yes | Yes | Yes | Yes | Yes | Yes |
Virtuozzo 7 | Yes | Yes | Yes | Yes | Yes | Yes |
Linux Oracle and Fedora — Agent version compatibility
Linux Distro and Version | 26.1 | 25.4 | 25.3 | 25.2 | 25.1 | 24.3 |
CloudLinux Shared v8, v6* | Yes | Yes | Yes | Yes | Yes | Yes |
Fedora 42 | Yes | Yes | Yes | No | No | No |
Fedora 41 | Yes | Yes | Yes | Yes | Yes | No |
Fedora 40 | Yes | Yes | Yes | Yes | Yes | Yes |
Fedora 39, 38 | Yes | Yes | Yes | Yes | Yes | Yes |
Fedora 37, 36, 35 | Yes | Yes | Yes | Yes | Yes | Yes |
Miracle Linux 8, 9 | Yes | Yes | Yes | Yes | No | No |
Oracle 9.8 | Yes | Yes | No | No | No | No |
Oracle 10.1, 10, 9.7, 9.6 | Yes | Yes | Yes | Yes | No | No |
Oracle 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Oracle 9.3, 9.2, 8.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Oracle 9.1, 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
Oracle 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
Oracle 9.0, 8.7–8.0, 7.9–7.0, 6.10, 6.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Note: CloudLinux Shared support includes hybrid and non-hybrid kernels. Containers are not supported.
Linux ARM operating system requirements
The Linux Agent for ARM is supported on Linux servers deployed on Amazon Elastic Compute Cloud (EC2) instances powered by Graviton2 and Graviton3 ARM processors.
Installation of the Linux ARM Agent works the same way as the x86 Linux Agent, provided the correct installer is used. The x86 package cannot be installed on ARM endpoints, and the ARM installer cannot be installed on x86 endpoints.
AWS GovCloud is not supported.
Login and logout event limitations
Unsuccessful login events, and login and logout events generally, are not currently detected on AlmaLinux 10, Oracle Linux 10, RHEL 10, and Rocky Linux 10.
Login and logout events are not currently detected on Debian 13.x.
Linux ARM — Agent compatibility
Linux Distro and Version | 26.1 | 25.4 | 25.3 | 25.2 | 25.1 | 24.3 |
AlmaLinux 10.1, 10, 9.7 | Yes | Yes | Yes | Yes | No | No |
AlmaLinux 10.2, 9.8 | Yes | Yes | No | No | No | No |
AlmaLinux 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.1, 9.0, 8.7, 8.6 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.3, 9.2 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
AlmaLinux 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.10, 2023.9, 2023.8 | Yes | Yes | Yes | Yes | No | No |
Amazon Linux 2023.12 | Yes | Yes | Yes | No | No | No |
Amazon Linux 2023.1, 2023 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.3 | Yes | Yes | Yes | Yes | Yes | Yes |
Amazon Linux 2023.7, 2023.6, 2023.5 | Yes | Yes | Yes | Yes | Yes | Yes |
CentOS 8.3 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11, 10 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.11, 11.10 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.8, 11.7, 10.13 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 11.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.10, 12.9 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.15 | Yes | Yes | No | No | No | No |
Debian 12.2, 12.1, 12 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 12.8, 12.7, 12.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Debian 13.5–13.0, 12.14–12.12 | Yes | Yes | Yes | Yes | No | No |
Debian 13.6 | Yes | No | No | No | No | No |
Fedora 42 | Yes | Yes | Yes | No | No | No |
RHEL 10.1, 10 | Yes | Yes | Yes | Yes | No | No |
RHEL 10.2 | Yes | Yes | No | No | No | No |
RHEL 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.1, 9.0, 8.4–8.7 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.3, 9.2, 8.9 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
RHEL 9.7, 9.6 | Yes | Yes | Yes | Yes | No | No |
RHEL 9.8 | Yes | Yes | Yes | No | No | No |
Rocky Linux 10.1, 10, 9.7 | Yes | Yes | Yes | Yes | No | No |
Rocky Linux 10.2, 9.8 | Yes | Yes | No | No | No | No |
Rocky Linux 8.10 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 8.8 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.1, 9.0, 8.7, 8.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.3, 9.2 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.4 | Yes | Yes | Yes | Yes | Yes | Yes |
Rocky Linux 9.5 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE 15 sp5 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE 15 sp6 | Yes | Yes | Yes | Yes | Yes | Yes |
SUSE 15 sp7 | Yes | Yes | Yes | Yes | No | No |
SUSE 15.x | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 20.04.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 22.04, 20.04, 18.04 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 24.04.1, 22.04.5 | Yes | Yes | Yes | Yes | Yes | Yes |
Ubuntu 24.04.2 | Yes | Yes | Yes | Yes | Yes | No |
Ubuntu 24.04.4, 24.04.3 | Yes | Yes | Yes | No | No | No |
Ubuntu 26.04 | Yes | No | No | No | No | No |
Required software
No additional software is required on baseline distro installations. If your Linux OS is customized, first get the list of requirements, then run one of the following commands:
rpm -qRp SentinelAgent_installerFileName.rpmdpkg -I SentinelAgent_installerFileName.deb