linux异常进程常用溯源操作命令

[root@VM-0-8-centos ~]# strace -p 18058Process 18058 attachedepoll_pwait(3, {}, 1024, 792, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_ctl(3, EPOLL_CTL_DEL, 13, {0, {u32=0, u64=0}}) = 0close(13) = 0epoll_pwait(3, {}, 1024, 0, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0futex(0x7fd5040faa24, FUTEX_WAKE_PRIVATE, 1) = 1futex(0x7fd505e743a4, FUTEX_WAKE_PRIVATE, 1) = 1epoll_pwait(3, {{EPOLLIN, {u32=8, u64=8}}}, 1024, 1000, NULL) = 1read(8, "1", 1024) = 8socket(PF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 13setsockopt(13, SOL_TCP, TCP_NODELAY, [1], 4) = 0setsockopt(13, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0setsockopt(13, SOL_TCP, TCP_KEEPIDLE, [60], 4) = 0setsockopt(13, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0setsockopt(13, SOL_TCP, TCP_KEEPCNT, [10], 4) = 0connect(13, {sa_family=AF_INET, sin_port=htons(8080), sin_addr=inet_addr("89.223.120.251")}, 16) = -1 EINPROGRESS (Operation now in progress)epoll_ctl(3, EPOLL_CTL_ADD, 13, {EPOLLOUT, {u32=13, u64=13}}) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_ctl(3, EPOLL_CTL_DEL, 14, {0, {u32=0, u64=0}}) = 0close(14) = 0epoll_pwait(3, {}, 1024, 0, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0socket(PF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 14setsockopt(14, SOL_TCP, TCP_NODELAY, [1], 4) = 0setsockopt(14, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0setsockopt(14, SOL_TCP, TCP_KEEPIDLE, [60], 4) = 0setsockopt(14, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0setsockopt(14, SOL_TCP, TCP_KEEPCNT, [10], 4) = 0connect(14, {sa_family=AF_INET, sin_port=htons(9090), sin_addr=inet_addr("77.232.138.109")}, 16) = -1 EINPROGRESS (Operation now in progress)epoll_ctl(3, EPOLL_CTL_ADD, 14, {EPOLLOUT, {u32=14, u64=14}}) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_ctl(3, EPOLL_CTL_DEL, 11, {0, {u32=0, u64=0}}) = 0close(11) = 0epoll_ctl(3, EPOLL_CTL_DEL, 12, {0, {u32=0, u64=0}}) = 0close(12) = 0epoll_pwait(3, {}, 1024, 0, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0socket(PF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 11setsockopt(11, SOL_TCP, TCP_NODELAY, [1], 4) = 0setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0setsockopt(11, SOL_TCP, TCP_KEEPIDLE, [60], 4) = 0setsockopt(11, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0setsockopt(11, SOL_TCP, TCP_KEEPCNT, [10], 4) = 0connect(11, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("5.39.79.206")}, 16) = -1 EINPROGRESS (Operation now in progress)socket(PF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 12setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0setsockopt(12, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0setsockopt(12, SOL_TCP, TCP_KEEPIDLE, [60], 4) = 0setsockopt(12, SOL_TCP, TCP_KEEPINTVL, [1], 4) = 0setsockopt(12, SOL_TCP, TCP_KEEPCNT, [10], 4) = 0connect(12, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("185.178.44.144")}, 16) = -1 EINPROGRESS (Operation now in progress)epoll_ctl(3, EPOLL_CTL_ADD, 11, {EPOLLOUT, {u32=11, u64=11}}) = 0epoll_ctl(3, EPOLL_CTL_ADD, 12, {EPOLLOUT, {u32=12, u64=12}}) = 0epoll_pwait(3, {}, 1024, 1000, NULL) = 0epoll_pwait(3, ^CProcess 18058 detached 

四、内核转储分析异常进程

gcore 18058    

使用 gcore 和 gdb 来创建进程的内核转储并进一步分析异常进程

gdb 可执行文件路径 core.PID

[root@VM-0-8-centos ~]# gcore 18058/.9dd770b8258ac0f19b66 (deleted): No such file or directory.warning: Memory read failed for corefile section, 8192 bytes at 0x38f8000.warning: Memory read failed for corefile section, 1048576 bytes at 0x38fa000.warning: Memory read failed for corefile section, 8192 bytes at 0x40fb000.warning: Memory read failed for corefile section, 1048576 bytes at 0x40fd000.warning: Memory read failed for corefile section, 8192 bytes at 0x48fe000.warning: Memory read failed for corefile section, 1048576 bytes at 0x4900000.warning: Memory read failed for corefile section, 8192 bytes at 0x5101000.warning: Memory read failed for corefile section, 1048576 bytes at 0x5103000.warning: Memory read failed for corefile section, 8192 bytes at 0x5907000.warning: Memory read failed for corefile section, 151552 bytes at 0x5909000.warning: Memory read failed for corefile section, 8192 bytes at 0x592e000.warning: Memory read failed for corefile section, 122880 bytes at 0x5931000.warning: Memory read failed for corefile section, 131072 bytes at 0x594f000.warning: Memory read failed for corefile section, 16384 bytes at 0x596f000.warning: Memory read failed for corefile section, 4096 bytes at 0x5973000.warning: Memory read failed for corefile section, 4096 bytes at 0x5974000.warning: Memory read failed for corefile section, 1048576 bytes at 0x5975000.warning: Memory read failed for corefile section, 1048576 bytes at 0x5c60000.warning: Memory read failed for corefile section, 630784 bytes at 0x5e60000.warning: Memory read failed for corefile section, 4096 bytes at 0x6b2e000.