Closed KKulishov closed 1 year ago
@KKulishov Please check whether your kernel is compiled with CONFIG_PERF_EVENTS:
grep CONFIG_PERF_EVENTS "/boot/config-$(uname -r)"
and debugfs is mounted:
mount|grep debugfs
here are the commands on the parent node
root@umt-k8s-mts-datapro-c1:/home/kulishovkm # grep CONFIG_PERF_EVENTS "/boot/config-$(uname -r)"
CONFIG_PERF_EVENTS=y
CONFIG_PERF_EVENTS_INTEL_UNCORE=y
CONFIG_PERF_EVENTS_INTEL_RAPL=y
CONFIG_PERF_EVENTS_INTEL_CSTATE=y
CONFIG_PERF_EVENTS_AMD_POWER=m
root@umt-k8s-mts-datapro-c1:/home/kulishovkm # mount|grep debugfs
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
Please check this directory as well:
ls -la /sys/kernel/tracing
/sys/kernel/debug/tracing
should be mounted for backwards compatibility, but this can be disabled due to CONFIG_TRACEFS_DISABLE_AUTOMOUNT=y
.
If so, we'll fix the agent to look for tracing
using both paths.
yes you are right
this ok
root@umt-k8s-mts-datapro-c1:/home/kulishovkm # ls -la /sys/kernel/tracing/
total 0
drwx------ 2 root root 0 Jul 17 07:57 .
drwxr-xr-x 14 root root 0 Jul 17 07:57 ..
but /sys/kernel/debug/tracing not found
root@umt-k8s-mts-datapro-c1:/home/kulishovkm # ls -la /sys/kernel/debug/tracing
ls: cannot access '/sys/kernel/debug/tracing': No such file or directory
No, it shouldn't be empty.
Check whether tracefs is mounted:
mount |grep tracefs
mount |grep tracefs
none on /sys/kernel/tracing type tracefs (rw,relatime)
but , catalog /sys/kernel/tracing is empty
rather, the problem is somewhere in the distribution, installed on the parent node redhat 8.5
@KKulishov have you been able to solve this issue?
@def not yet, my company has modified the kernel, now I have created a resolution task in the kernel ftrace. I will communicate with my security service.
@def
The problem was in the kernel boot options, which turned off , in grub:
kernelopts=root=/dev/mapper/vgroot-root ro resume=/dev/mapper/vgroot-swap lockdown=confidentiality debugfs=off
if you remove lockdown=confidentiality debugfs=off and in grub and reboot.
all ok
/sys/kernel/debug/tracing and /sys/kernel/tracing no longer empty
security guys patched kernel boot options kernel_opts
Thank you for your help
@KKulishov thank you for the details
Deploy to kubernetes 1.20 (rancher 2.5) container (docker 20.10.17) .
Always restart coroot-node-agent , logs:
checking directories on the parent node
linux kernel 5.4 on parent node
image version coroot-node-agent 1.8.8
this my DaemonSet
Can you tell me what I'm doing wrong