Hi,

Could you post the docker command that you are used to exec the forwarder?

Can you share the full error? Is the "No such file or directory error" referencing the forwarder conf file or the audit.log file?

Hi @cmorris ,

Please find the snip of error which i got.

     docker run 


       --detach 


       --name cfps 


       --log-opt max-size=100m 


       --log-opt max-file=10 


       --net=host 


       -v /opt/chronicle/config:/opt/chronicle/external 


       -v /var/log/crowdstrike/falconhostclient:/opt/chronicle/edr 


       gcr.io/chronicle-container/cf_production_stable

   

Sorry but I don’t understand very well the problem, could you post the config file (obviously without the auth section)?

     docker run 


       --detach 


       --name cfps 


       --log-opt max-size=100m 


       --log-opt max-file=10 


       --net=host 


       -v /opt/chronicle/config:/opt/chronicle/external 


       -v /var/log/crowdstrike/falconhostclient:/opt/chronicle/edr 


       gcr.io/chronicle-container/cf_production_stable

   

Can you check if the command below works?

     docker run 


       --detach 


       --name cfps 


       --log-opt max-size=100m 


       --log-opt max-file=10 


       --net=host 


       -v /opt/chronicle/config:/opt/chronicle/external 


       -v /opt/logs:/opt/chronicle/edr 


       gcr.io/chronicle-container/cf_production_stable