Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy, realtime, system-wide Shellshock monitoring

draios.com

Post reply on HN
Print view View original

1–10 of 34 posts

Re: Easy, realtime, system-wide Shellshock monitoring

#5

Post by gighi »

mikegioia wrote: post #4

This looks cool but I can't get it running on Ubuntu 14.04. I just installed sysdig but I don't have the shellshock_detect chisel :/ Is it available yet through apt?

What do you get if you run "sysdig --version"?

If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig.

What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-...

Should be very easy, and sysdig --version should show 0.1.89

Re: Easy, realtime, system-wide Shellshock monitoring

#6

Post by gighi »

zobzu wrote: post #2

well, installing a LKM, just that =p Now sysdig aint bad per se but id like to see it mainlined or using mainline code

Fair point, even though:

- At this point sysdig is estimated to have tens of thousands of users, and we haven't gotten a kernel bug in a while, with people (us included) regularly using it a lot in production. Of course, I see the irony of mentioning this in a "shellshock" thread

- the dkms packaging should completely hide all the complexities required in maintaining a kernel module

- Part of the kernel code, if you look at the contributors, has been written/reviewed by gregkh, so we like to think the quality is "high enough"

- There might be plans at some point to try and propose a merge of the code to mainline

Re: Easy, realtime, system-wide Shellshock monitoring

#7

Post by mikegioia »

gighi wrote: post #5
mikegioia wrote: post #4

This looks cool but I can't get it running on Ubuntu 14.04. I just installed sysdig but I don't have the shellshock_detect chisel :/ Is it available yet through apt?

What do you get if you run "sysdig --version"? If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig . What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-…

Ah ok, mine says "sysdig version 0.1.87". Thanks, I'll give that a shot instead.

Re: Easy, realtime, system-wide Shellshock monitoring

#8

Post by iachimoe »

gighi wrote: post #5
mikegioia wrote: post #4

This looks cool but I can't get it running on Ubuntu 14.04. I just installed sysdig but I don't have the shellshock_detect chisel :/ Is it available yet through apt?

What do you get if you run "sysdig --version"? If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig . What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-…

version on brew is 0.1.88. What's the best way for mac users to get this?

Re: Easy, realtime, system-wide Shellshock monitoring

#9

Post by gighi »

iachimoe wrote: post #8
gighi wrote: post #5

Earlier quoted context omitted.

What do you get if you run "sysdig --version"? If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig . What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-…

version on brew is 0.1.88. What's the best way for mac users to get this?

Yeah, bummer, I can submit a PR to Homebrew but it would take a few hours/days, and we don't ship OSX binaries from Draios, so why don't you go with:

https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-...

Assuming you have a C/C++ compiler installed (comes via XCode) it really takes like 2 minutes.

Lazy alternative, in a couple days maximum Homebrew should be updated, unfortunately it doesn't depend on us.

Also, notice that sysdig for OSX doesn't (yet) have live capture, so you'll just be able to run the chisel on a trace file that you previously created on a Linux host.

Post reply on HN