使用BCC工具报错
[root@server02 ~]# /usr/share/bcc/tools/execsnoop
modprobe: FATAL: Module kheaders not found in directory /lib/modules/5.10.0-60.18.0.50.r1083_58.hce2.x86_64
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.
chdir(/lib/modules/5.10.0-60.18.0.50.r1083_58.hce2.x86_64/build): No such file or directory
Traceback (most recent call last):
File "/usr/share/bcc/tools/execsnoop", line 227, in <module>
b = BPF(text=bpf_text)
File "/usr/lib/python3.9/site-packages/bpfcc/__init__.py", line 479, in __init__
raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>经过确认，此类报错一般就是需要更新内核模块
内核升级
[root@server02 ~]# yum -y install kernel-headers
Last metadata expiration check: 0:51:49 ago on Mon 15 Jul 2024 03:42:51 PM CST.
Package kernel-headers-5.10.0-182.0.0.95.r1941_123.hce2.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@server02 ~]# yum -y install kernel-devel-$(uname -r)
Last metadata expiration check: 0:52:06 ago on Mon 15 Jul 2024 03:42:51 PM CST.
Dependencies resolved.
===============================================================================================================================================================================================================================================================================================================================
Package Architecture Version Repository Size
===============================================================================================================================================================================================================================================================================================================================
Downgrading:
kernel-devel x86_64 5.10.0-60.18.0.50.r1083_58.hce2 updates 17 M
Transaction Summary
===============================================================================================================================================================================================================================================================================================================================
Downgrade 1 Package
Total download size: 17 M
Downloading Packages:
kernel-devel-5.10.0-60.18.0.50.r1083_58.hce2.x86_64.rpm
验证
执行opensnoop命令，已经可以顺利使用
[root@server02 ~]# /usr/share/bcc/tools/opensnoop
PID COMM FD ERR PATH
775 hostwatch 5 0 /proc/775/stat
775 hostwatch 5 0 /proc/804/stat
775 hostwatch 5 0 /usr/local/hostguard/run/heartbeat.tick
775 hostwatch 5 0 /proc/1659/stat
775 hostwatch 5 0 /sys/devices/system/cpu/online
775 hostwatch 5 0 /usr/local/hostguard/run/restart.conf
775 hostwatch 5 0 /proc/meminfo
670 irqbalance 7 0 /proc/irq/affinity_hint_notify
670 irqbalance 7 0 /proc/irq/affinity_hint_notify
775 hostwatch 5 0 /proc/775/stat
775 hostwatch 5 0 /proc/804/stat
775 hostwatch 5 0 /usr/local/hostguard/run/heartbeat.tick
775 hostwatch 5 0 /proc/1659/stat
775 hostwatch 5 0 /sys/devices/system/cpu/online
775 hostwatch 5 0 /usr/local/hostguard/run/restart.conf
775 hostwatch 5 0 /proc/meminfo
配置环境变量
为保证可以更方便使用bcc命令，将对应路径加入/etc/profile文件内。
echo "export PATH='/usr/local/bcc/tools:$PATH'" >> /etc/profile
