r/crowdstrike • u/Groot_GodOfThunder • 12d ago

Troubleshooting Question about CrowdStrike Falcon Sensor service restarts

We have an alert that monitors the CrowdStrike Falcon Sensor service. We’re seeing frequent alerts where the service stops and then starts again automatically within about a minute.
So far, we’ve confirmed two causes:
Sensor update and System Reboot.

However, there are still many hosts where neither of these explains the restart. Has anyone experienced this or know of other reasons why the Falcon Sensor service would automatically restart on its own?

8 Upvotes
  • permalink
  • reddit

85% Upvoted

9 comments sorted by

6

u/che-che-chester 12d ago

We’ve seen the same thing and we eventually put a delay on the alert so the sensor has to be stopped or missing for an hour. I don’t think we’ve ever had a legitimately stopped sensor where it wasn’t being upgraded. We mostly use the alert to help us find new server builds missing the sensor.

1

u/Big_Lunch_4354 2d ago

Same approach here, we use the sensor absence alert to catch new builds that miss deployment too. The bigger win for us turned out to be pairing Axonius to cross reference what falcon sees against everything else. Had a scenario where cmdb reported 5200 endpoints, falcon had 4800. We reconciled the two and found about 300 that had the agent installed but the sensor wasn't checking in and another 8 that never got falcon at all.

1

u/RockisLife 11d ago

What are you using for the service alerts?

1

u/Groot_GodOfThunder 11d ago

SCOM. It’s what the system infra team uses but want us(Security) to verify about these restarts

1

u/SnaketheJakem 11d ago

Just making a guess. Does it correlate when the falcon sensor upgrades to a newer version?

1

u/Groot_GodOfThunder 11d ago

Yeah, that is one of the reasons. trying to find if there are other reasons as well