产品动态
公告
产品发布记录
apt install -y systemtap
stap-prep
Please install linux-headers-4.4.0-104-genericYou need package linux-image-4.4.0-104-generic-dbgsym but it does not seem to be availableUbuntu -dbgsym packages are typically in a separate repositoryFollow https://wiki.ubuntu.com/DebuggingProgramCrash to add this repositoryapt install -y linux-headers-4.4.0-104-generic
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C8CAB6595FDFF622codename=$(lsb_release -c | awk '{print $2}')sudo tee /etc/apt/sources.list.d/ddebs.list << EOFdeb http://ddebs.ubuntu.com/ ${codename} main restricted universe multiversedeb http://ddebs.ubuntu.com/ ${codename}-security main restricted universe multiversedeb http://ddebs.ubuntu.com/ ${codename}-updates main restricted universe multiversedeb http://ddebs.ubuntu.com/ ${codename}-proposed main restricted universe multiverseEOFsudo apt-get update
stap-prep
Please install linux-headers-4.4.0-104-genericPlease install linux-image-4.4.0-104-generic-dbgsym
apt install -y linux-image-4.4.0-104-generic-dbgsym
apt install -y linux-headers-4.4.0-104-generic
yum install -y systemtap
/etc/yum.repos.d/CentOS-Debug.repo 配置文件中输入以下内容并保存，本文以默认未安装 debuginfo 为例。[debuginfo]name=CentOS-$releasever - DebugInfobaseurl=http://debuginfo.centos.org/$releasever/$basearch/gpgcheck=0enabled=1protect=1priority=1
kernel-debuginfo。stap-prep
kernel-devel。rpm -qa | grep kernel-devel
kernel-devel-3.10.0-327.el7.x86_64kernel-devel-3.10.0-514.26.2.el7.x86_64kernel-devel-3.10.0-862.9.1.el7.x86_64
3.10.0-862.9.1.el7.x86_64，结合上述返回结果需执行以下命令删除多余版本。uname -r 命令查看内核版本。 kernel-debuginfo 和 kernel-devel 均已安装并且安装版本与当前内核版本相同。rpm -e kernel-devel-3.10.0-327.el7.x86_64 kernel-devel-3.10.0-514.26.2.el7.x86_64
modprobe 加载到内核。kubectl describe pod <pod name>
......Container ID: docker://5fb8adf9ee62afc6d3f6f3d9590041818750b392dff015d7091eaaf99cf1c945......Last State: TerminatedReason: ErrorExit Code: 137Started: Thu, 05 Sep 2019 19:22:30 +0800Finished: Thu, 05 Sep 2019 19:33:44 +0800
docker inspect -f "{{.State.Pid}}" 5fb8adf9ee62afc6d3f6f3d9590041818750b392dff015d7091eaaf99cf1c945
7942
Exit Code 可以获取容器上次退出的状态码。本文以137为例，进行以下分析：SIGKILL 信号停止的，但此时仍不能确定进程停止原因。sg.stp 文件，输入以下 Systemtap 脚本内容并保存。global target_pid = 7942probe signal.send{if (sig_pid == target_pid) {printf("%s(%d) send %s to %s(%d)\\n", execname(), pid(), sig_name, pid_name, sig_pid);printf("parent of sender: %s(%d)\\n", pexecname(), ppid())printf("task_ancestry:%s\\n", task_ancestry(pid2task(pid()), 1));}}
stap sg.stp
pkill(23549) send SIGKILL to server(7942)parent of sender: bash(23495)task_ancestry:swapper/0(0m0.000000000s)=>systemd(0m0.080000000s)=>vGhyM0(19491m2.579563677s)=>sh(33473m38.074571885s)=>bash(33473m38.077072025s)=>bash(33473m38.081028267s)=>bash(33475m4.817798337s)=>pkill(33475m5.202486630s)
task_ancestry ，可以看到停止进程的所有父进程。例如，此处可以看到一个名为 vGhyM0 的异常进程，该现象通常表明程序中存在木马病毒，需要进行相关病毒清理工作以确保容器正常运行。文档反馈