$ ps aux | grep san root 1183 0.0 0.0 113184 1492 ? S Feb09 0:03 /bin/bash /sangfor/edr/agent/bin/eps_services_ctrl root 5132 0.0 0.0 113436 1696 ? S Feb09 0:17 /bin/bash /sangfor/edr/agent/bin/abs_monitor root 5164 0.0 0.0 48092 3392 ? S Feb09 0:04 /sangfor/edr/agent/bin/abs_deployer root 5205 0.0 0.0 43036 1552 ? Ss Feb09 0:07 /sangfor/edr/agent/bin/edr_monitor root 5378 0.0 0.0 194948 6260 ? Sl Feb09 0:04 /sangfor/edr/agent/bin/sfupdatemgr -p edr_monitor root 5379 0.0 0.0 43360 3560 ? S Feb09 0:01 /sangfor/edr/agent/bin/ipc_proxy root 5380 0.6 0.1 708028 29892 ? Sl Feb09 6:56 /sangfor/edr/agent/bin/edr_agent root 5381 0.1 0.0 17060 1332 ? S< Feb09 1:58 /sangfor/edr/agent/bin/cpulimit --limit=50 --exe=edr_agent root 5382 0.0 0.0 113568 1900 ? S Feb09 0:28 /bin/bash /sangfor/edr/agent/bin/asset_collection_cpulimit.sh root 5383 0.0 0.0 128944 5444 ? Sl Feb09 0:27 /sangfor/edr/agent/bin/edr_sec_plan root 5384 0.0 0.0 117656 8956 ? S Feb09 0:00 /sangfor/edr/agent/bin/lloader /sangfor/edr/agent/bin/../lmodules/isolate_area_tool.lua root 5385 0.0 0.0 68916 3928 ? S Feb09 0:01 /sangfor/edr/agent/bin/lloader /sangfor/edr/agent/bin/../lmodules/isolate_area_main.lua root 22594 0.0 0.0 112712 976 pts/2 S+ 11:37 0:00 grep --color=auto san $ uptime -s 2022-02-09 17:19:09 You have new mail in /var/spool/mail/root $ tail -n 40 /var/spool/mail/root ... edr pid 5205 ls: cannot access /sangfor/edr/agent/bin/../packages/: No such file or directory
$ ll /etc/cron.d total 12 -rw-r--r--. 1 root root 128 Aug 3 2017 0hourly -rw-r--r-- 1 root root 60 Dec 10 2020 edr_agent -rw-------. 1 root root 235 Apr 1 2020 sysstat You have new mail in /var/spool/mail/root $ cat edr_agent * * * * * root /sangfor/edr/agent/bin/eps_services_check.sh
让客户卸载掉后还是不行，然后 save 了下发现了问题：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
$ docker save -o test.tar xxx.cn/base/xxxxxx-amd64:v2 Error response from daemon: open /data/kube/docker/overlay2/920a06a6d4eb64db0898234cd3a81b01115d6fcc2cfc50c5107e0205f7230318/diff/lib/x86_64-linux-gnu/ld-2.23.so: no such file or directory $ docker inspect xxx.cn/base/xxxxxx-amd64:v2 | grep 920a0 "LowerDir": ...:/data/kube/docker/overlay2/920a06a6d4eb64db0898234cd3a81b01115d6fcc2cfc50c5107e0205f7230318/diff",
$ ls -l /data/kube/docker/overlay2/920a06a6d4eb64db0898234cd3a81b01115d6fcc2cfc50c5107e0205f7230318/diff/lib/x86_64-linux-gnu/ | head total 10684 lrwxrwxrwx 1 root root 10 Feb 6 2019 ld-linux-x86-64.so.2 -> ld-2.23.so lrwxrwxrwx 1 root root 15 Feb 7 2016 libacl.so.1 -> libacl.so.1.1.0 -rw-r--r-- 1 root root 31232 Feb 7 2016 libacl.so.1.1.0 -rw-r--r-- 1 root root 14992 Feb 6 2019 libanl-2.23.so lrwxrwxrwx 1 root root 14 Feb 6 2019 libanl.so.1 -> libanl-2.23.so lrwxrwxrwx 1 root root 20 May 29 2019 libapparmor.so.1 -> libapparmor.so.1.4.0 -rw-r--r-- 1 root root 64144 May 29 2019 libapparmor.so.1.4.0 lrwxrwxrwx 1 root root 16 Sep 9 2014 libattr.so.1 -> libattr.so.1.1.0 -rw-r--r-- 1 root root 18624 Sep 9 2014 libattr.so.1.1.0
把那个镜像的离线文件拿到其他机器上 load 后看了下该层是有文件 ld-2.23.so 的:
1 2 3 4
$ ll b5f1b3d6665a476b9460532568499f2923c1621d710f6a1e20cf7f3e1a928e17/diff/lib/x86_64-linux-gnu/ total 10844 -rwxr-xr-x 1 root root 162632 Feb 6 2019 ld-2.23.so lrwxrwxrwx 1 root root 10 Feb 6 2019 ld-linux-x86-64.so.2 -> ld-2.23.so
