Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmdline 如果被进程重写,现有逻辑将无法忽略空格。 #32

Open
YouZhengChuan opened this issue Jun 2, 2020 · 1 comment

Comments

@YouZhengChuan
Copy link

nux/proc.go

Line 67 in debb382

if cmdlineBytes[j] != 0 {

有一些进程,例如nginx会重写cmdline:

[root@vm-vm114 falcon-agent]# ps aux|grep nginx
root     14811  0.0  0.0 108964  1884 ?        Ss   19:18   0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
nginx    14812  0.0  0.1 109388  2736 ?        S    19:18   0:00 nginx: worker process
nginx    14813  0.0  0.1 109388  2656 ?        S    19:18   0:00 nginx: worker process
root     15182  0.0  0.0 103336   864 pts/2    S+   19:57   0:00 grep nginx
[root@vm-vm114 falcon-agent]#
[root@vm-vm114 falcon-agent]# xxd /proc/14811/cmdline
0000000: 6e67 696e 783a 206d 6173 7465 7220 7072  nginx: master pr
0000010: 6f63 6573 7320 2f75 7372 2f73 6269 6e2f  ocess /usr/sbin/
0000020: 6e67 696e 7820 2d63 202f 6574 632f 6e67  nginx -c /etc/ng
0000030: 696e 782f 6e67 696e 782e 636f 6e66       inx/nginx.conf

可以看到,原本看起来应该是0x00的地方,却用0x20(空格字符),falcon-agent在使用这个库获取到的进程含有空格,会导致cmdline无法匹配上。

@UlricQin
Copy link
Member

UlricQin commented Jun 2, 2020

这确实是个问题,不过nginx用进程名来匹配是不是更好一点呢

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants