search

bytedance / Elkeid

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
https://elkeid.bytedance.com
2.27k stars 441 forks source link

下发卸载插件任务agent端未生效 #252

Closed 0xlwoe21k closed 2 years ago

0xlwoe21k commented 2 years ago

服务端执行下发卸载driver插件的任务显示成功，但是agent端未生效。

image

[root@aliyun-10-43-28-87 plugin]# ls
collector  driver  journal_watcher  scanner
[root@aliyun-10-43-28-87 plugin]# ls
collector  driver  journal_watcher  scanner
[root@aliyun-10-43-28-87 plugin]# date
Wed Jun  8 14:53:25 CST 2022
[root@aliyun-10-43-28-87 plugin]# ps -ef | grep elk
root      9164     1  0 May19 ?        00:25:01 /etc/elkeid/elkeid-agent
root      9364  9164  0 May19 ?        00:01:55 /etc/elkeid/plugin/journal_watcher/journal_watcher
root      9372  9164  0 May19 ?        00:03:15 /etc/elkeid/plugin/scanner/scanner
root      9383  9164  0 May19 ?        00:11:40 /etc/elkeid/plugin/collector/collector
root     24599  9164  0 14:45 ?        00:00:00 /etc/elkeid/plugin/driver/driver
root     24607     2  0 14:45 ?        00:00:00 [elkeid - DNS kr]
root     24608     2  0 14:45 ?        00:00:00 [elkeid - antiro]
root     25364 23907  0 14:51 pts/0    00:00:00 tail -f elkeid-agent.log
root     25599 25482  0 14:53 pts/1    00:00:00 grep elk
[root@aliyun-10-43-28-87 plugin]#

agent日志信息

2022-06-08T14:52:01.427+0800    INFO    heartbeat/heartbeat.go:131      plugin heartbeat completed:map[cpu:0.00149998 du:8083872 fd_cnt:10 name:driver pid:9164 pversion:1.7.0.1 read_speed:0.00000000 rss:2707456 rx_speed:0.00000000 rx_tps:0.00000000 started_at:1654670733 tx_speed:11841.79616014 tx_tps:13.71650778 write_speed:136.53177739]
2022-06-08T14:52:29.018+0800    INFO    transport/transfer.go:156       received command
2022-06-08T14:52:29.018+0800    INFO    plugin/plugin.go:197    syncing plugins...
2022-06-08T14:52:29.018+0800    INFO    plugin/plugin.go:225    sync done
2022-06-08T14:53:01.426+0800    INFO    heartbeat/heartbeat.go:98       agent heartbeat completed:map[arch:x86_64 boot_at:1634519929 cpu:0.00150000 du:27534634 fd_cnt:18 grs:27 idc:default kernel_version:2.6.32-696.30.1.el6.x86_64 load_1:1.56 load_15:2.56 load_5:2.42 net_mode:private nproc:4 pid:9164 platform:centos platform_family:rhel platform_version:6.9 read_speed:0.00000000 region:default rss:26341376 running_procs:2 rx_speed:8.86662775 rx_tps:0.01666659 started_at:1652949000 total_procs:535 tx_speed:1524.07664421 tx_tps:5.74997476 write_speed:136.53293926]
Percivalll commented 2 years ago

Not support uninstall plugin right now, because of default config.