File: //usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyo
�
�]ic @ s d d l Z d d l Z d d l Z d d l Ti d d 6d d 6d d 6d d
6d d 6d
d 6d d 6d d 6d d 6d d 6d d 6Z i d d 6d d 6Z i d d 6d d 6d d 6d d 6d d
6Z e d � Z d! � Z d" � Z
d# � Z e d$ d% � e
� d& e f d' � � Y� � Z d S(( i����N( t *t ESTABLISHEDi t SYN_SENTi t SYN_RECVi t FIN_WAIT1i t FIN_WAIT2i t TIME_WAITi t CLOSEi t
CLOSE_WAITi t LAST_ACKi t LISTENi
t CLOSINGi t UNCONNt FREEi t UNCONNECTEDt
CONNECTINGt CONNECTEDt
DISCONNECTINGc
s� � f d � } � f d � } � f d � } i } t j d | � } t j j | � s\ | Sx� t j | � D]� } | d k r� | | t j j | | � | � ql | d
k r� | t j j | | � | � ql | d k rl | t j j | | � | � ql ql W| S( s*
获取指定 PID 的网络信息
c sF t | d � �1} | j � } x| d D] } | j � j � } t | � d k rY q) n | d j d � } | d j d � } d | k s� d | k s� d | k s� d | k r� t j t j t j | d
� d d d � � } n\ d
| k sd | k sd | k sd | k r=t j
t j | d
� d d d � � } n t | d d � }
d | k s�d | k s�d | k s�d | k r�t j t j t j | d
� d d d � � } n\ d
| k s�d | k s�d | k s�d | k rt j
t j | d
� d d d � � } n t | d d � } d | k s9d | k r[t j
t | d d � d � }
n t j
t | d d � d � }
| d j d � } t | d
d � d } t | d d � d } t | d d � } | d } � r�i | | <q) i | d 6| d 6|
d 6| d 6| d 6|
d 6| d 6| d 6| d 6| | <q) W| SWd QXd S(! se
raw:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
raw6:
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
udp:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
udp6:
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
udplite:
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
udplite6:
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops
tcp:
sl(0) local_address(1) rem_address(2) st(3) tx_queue(4.1) rx_queue(4.2) tr(5.1) tm->when(5.2) retrnsmt(6) uid(7) timeout(8) inode(9)
0: 0100007F:8E9E 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 437261903 1 ffff8b72b20b9ec0 100 0 0 10 0
1: 0100007F:9286 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 437261901 1 ffff8b72b20b8a40 100 0 0 10 0
tcp6:
sl local_address remote_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
0: 00000000000000000000000000000000:0CEA 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000 27 0 348608123 1 ffff8b6f92402c00 100 0 0 10 0
Args:
file_path (_type_): _description_
Returns:
_type_: _description_
t ri i t :i t tcp6t udp6t udplite6t raw6i Ni����t tcpt udpt udplitet rawi i t UNKNOWNi i i i t protocolt local_ipt
local_portt remote_ipt remote_portt statet tx_queuet rx_queuet retrnsmt( t opent readlinest stript splitt lent sockett inet_ntopt AF_INET6t mem_utilst bytes_to_hext inet_ntoat intt udp_state_tablet gett tcp_state_table( R t file_patht net_infot ft linest linet partst
local_addresst remote_addressR R R R! R" t queuesR# R$ R% t inode( t lite_mode( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_net_info1 sn , & , &"
c s� t | d � �� } | j � } x� | d D]� } | j � j � } t | � d k rY q) n t j t | d d � d � } | d } t | � d k r� d n | d } � r� i | | <q) i d
d 6| d 6| d
6| | <q) WWd QX| S( sa
Num RefCount Protocol Flags Type St Inode Path
ffff8b72cf6baac0: 00000002 00000000 00010000 0001 01 395986121 /tmp/vscode-ipc-0d2808c9-da6b-4de6-8d16-481eb31065b1.sock
ffff8b72bcf84280: 00000002 00000000 00010000 0001 01 358505400 /tmp/vscode-remote-containers-ipc-25cb7b04-babc-4e11-a1e0-ea1b08a8f681.sock
ffff8b75942c9300: 00000002 00000000 00010000 0001 01 381216346 /tmp/vscode-remote-containers-ipc-e985c9e2-6762-4241-a26b-cd22049a0abb.sock
Args:
file_path (_type_): _description_
Returns:
_type_: _description_
R i i i i R i i t t unixR t pathR" N( R& R' R( R) R* t unix_state_tableR3 R1 ( R5 R6 R7 R8 R9 R: R" R> RC ( R? ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_unix_net_info� s
"
)c s� t | d � �� } | j � } xj | d D]^ } | j � j � } t | � d k rY q) n | d } � rv i | | <q) i d d 6| | <q) WWd QX| S( sn
sk Eth Pid Groups Rmem Wmem Dump Locks Drops Inode
ffff8b6f15f80000 0 0 00000000 0 0 0 2 0 348606852
ffff8b6f0a6a0000 0 68519 00000000 0 0 0 2 0 348598154
ffff8b732952e000 0 133 000405d1 0 0 0 2 0 348609623
ffff8b6f966d4800 4 0 00000000 0 0 0 2 0 34860687
Args:
file_path (_type_): _description_
Returns:
_type_: _description_
R i i i����t netlinkR N( R& R' R( R) R* ( R5 R6 R7 R8 R9 R: R> ( R? ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_netlink_net_info� s
s /proc/%s/netR R R R R R R R RB RF ( s tcps tcp6s udps udp6s udplites udplite6s raws raw6( R. t
get_real_patht osRC t existst listdirt join( t pidR? R@ RE RG R6 t net_pathR ( ( R? s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_pid_net_info, s. f " #c C su t j d | � } y: t j j t j d | � � s9 d St j | � } | SWn! t k
rp } t j | � d SXd S( s� 获取进程的 net namespace id
lrwxrwxrwx 1 root root 0 Jul 28 10:30 /proc/64858/ns/net -> 'net:[4026531994]'
Args:
pid (int): 进程ID
Returns:
int: net namespace id
s /proc/%s/ns/nets /proc/%sN( R. RH RI RC RJ t Nonet readlinkt Exceptiont log_exception_in_debug_mode( RM RN t link_targett e( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_pid_net_namespace_id� s
c
C s� d � } t j d | � } y[t j j | � s5 d Si d d 6d d 6d d 6d d 6d d 6d d 6d d
6d d 6d d 6d d
6d d 6d d 6} t | d � ��} x�| j � D]�} | j d � r� | | � } | j d d � | d <q� | j d � rt| | � } | j d d � | d <| j d d � | d <| j d d � | d <| j d d � | d <| j d d � | d <q� | j d � r�| | � } | j d d � | d
<| j d d � | d <q� | j d � s�| j d � r | | � } | j
d � d j � } | j d d � | d | <q� | j d � r� | | � } | j d d � | d <| j d d � | d <q� q� WWd QX| SWn! t k
r�} t j
| � d SXd S(! s: 获取 PID 所在网络命名空间的 socket 统计信息c S s& | s d | k r# d | k r# i S| j � j � } i } d } x� | t | � k r!| | } | j d � r| | d } n | d 7} g } xA | t | � k r� | | j � r� | j | | � | d 7} q� W| rD t | � d k r� t | d � n g | D] } t | � ^ q� | | <qD qD W| S( sB 通用解析函数：将一行 sockstat 内容按 key-value 解析t usedt inusei R i����i ( R( R) R* t endswitht isdigitt appendR1 ( R9 R: t kv_pairst it keyt valuest v( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt
parse_line s"
%Ls /proc/%s/net/sockstati t socket_usedt tcp_inuset
tcp_orphant tcp_twt tcp_alloct tcp_memt udp_inuset udp_memt
udplite_inuset raw_inuset
frag_inuset frag_memR s sockets:RW s TCP:RX t orphant twt alloct mems UDP:s UDPLITE:s RAW:R s %s_inuses FRAG:t memoryN( R. RH RI RC RJ RP R& R' t
startswithR3 R) t lowerRR RS ( RM Ra t
sockstat_patht resultR7 R9 t parsedR RU ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_sockstat_by_pid s\
#
c C s2 d � } d � } | s t S| | � o1 | | � S( Nc S s{ t j d � | d } y= t | d � �( } x | D] } d | k r3 t Sq3 WWd QXWn t k
rv } t j | � n Xt S( s9
检查进程是否加载了libjvm.so库
s /proc/s /mapsR s libjvm.soN( R. RH R& t TrueRR RS t False( RM RC t fdR9 RU ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt
checkJavaMapsN s
c S s� t j d � | d } yH t | d � �3 } | j � } | j � } d | k rT t St SWd QXWn t k
r� } t j | � n Xd S( s=
检查进程名是否带有 java 关键字
s /proc/s /commR t javaN( R. RH R& t readt rstripRy Rz RR RS ( RM RC R7 t comnt commRU ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt readJavaComnand^ s
( Rz ( RM R| R� ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt check_is_java_processM s
t namet taskProct TaskProcPluginc B s2 e Z d Z d � Z d � Z d � Z d � Z RS( sg 任务 proc 信息采集插件, 如果在容器中运行诊断，需要共享pid namespace参数
输出：
1. taskInfo: 任务的内存信息，包含PID，名称，用户态匿名内存（RssAnon），用户态文件内存（RssFile），
用户态共享内存（RssShmem），任务实际使用的物理内存（VmRSS）。
{
"1": {
"Name": "systemd",
"Pid": "1",
"RssAnon": 3208,
"RssFile": 4820,
"RssShmem": 0,
"VmRSS": 8028
}
...
}
2. taskSortedByAnon: 任务按照匿名内存降序排序。
[["1212062", 2953484], ["1298842", 2939456], ["<任务ID>", <匿名内存用量，单位KB>]]
3. taskSortedByVmRss: 任务安装实际占用的物理内存排序。
[["1212062", 2953484], ["1298842", 2939456], ["<任务ID>", <物理内存用量，单位KB>]]
4. filePidMap: 文件和进程的映射关系。
{"/dev/shm/test": ["1234", "5678"], "/tmp/test": ["1234", "5678"]}
5. memTop: Top 30 内存占用的任务信息
c C s | j j d t � } t j d � | d } i d d 6} y�g } g } x�t j | � D]�} | d | }
t j j |
� r� qX n t j j |
� s� qX n t j
|
� j � } t | � d k r� qX n | d d k r� | r� d | k r� qX q� n | d d !d k rqX n | d d
!d k r'qX n | | k r@g | | <n | | j
| � d | k rX | j � j d
� } t | � d k r�qX n | d c d 7<| d d j � } | j
| � | | k r�| j
| � q�qX qX W| | d <| | d <Wn t k
r}
t j |
� n X| S( s� 扫描指定
Args:
file_map (_type_): filename -> [pid1, pid2, ...]
通过这个映射关系，可以知道哪些文件被哪些进程打开
例如：{"/dev/shm/test": ["1234", "5678"], "/tmp/test": ["1234", "5678"]}
sockets (_type_): [socket1_inode, socket2_inode, ...]
通过这个列表，可以知道系统中有哪些 socket 文件被打开
pid (_type_): 目标进程
t enable_socket_scans /proc/s /fdi t socket_countt /i R+ i i s /sys/s socket:[t [i i����t may_leak_socket_inodest all_socket_inodes( t paramsR3 Ry R. RH RI RK RC t isdirRJ RQ R( R* R[ R) RR RS ( t selft file_mapRM t net_info_mapR� t filenameRv R� R� R{ t fd_patht tmpR> RU ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt scan_proc_file� sP
c C sP g } t | d d � �1 } x' | j � D] } | j | j � � q) WWd QX| S( Ns
/cgroup.procsR ( R& R' R[ R( ( R� t cgroup_patht pidsR7 R9 ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt get_cgroup_procs� s
c s� � f d � } t � } g } t j d � } � j j d t � } | rP| j d � j d � } | j d � j d � } | j d � j d � } | | j d d � }
| j d
d � } � j |
� } | | | � } | j | | � x� | D]\ }
|
j d d � } | |
j d d � } � j | � } | | | � } | j | | � q� WnC t
j | � } | | | � } x" | D] } | j | | | � quW| S(
Nc $ s� i } i } i } i } i } i } i } i } x� | D]� }
ym t j j | |
� s\ w7 n t j |
� sq w7 n t |
� } | | |
<| | k r� t |
t � | | <n Wq7 t k
r� } t j | � q7 Xq7 Wi }
t j
� } x�| D]�}
y�t j j | |
� sw� n t j |
� s$w� n | |
d } d } | |
d k rY| | |
} n � j | |
| � } | |
|
<t
| d � �>} | j � } d j | � j d � d k r�w� n i } xZ | D]R } | j � j � } t | � d k r�q�n | d d } | d } | | | <q�Wi } | d | d <| d
| d
<t | d � | d <t | d � | d <t | d � | d <t | d
� | d
<| | |
<t | d � | |
<t | d
� | |
<Wd QX| |
d } t j j | � r7t
| d � �< } | j � j � } | r.| j d d � | |
d <n Wd QXn t j |
� } | | |
d <| | k ru| | | |
d <n t |
� r�d | |
d <n d | |
d <Wq� t k
r�} t j | � q� Xq� Wi } i } xw| D]o}
yFt j j | |
� s w�n t j |
� sw�n t |
� } | | |
<| | k r�t |
t � | | <t |
� } | | d <| d k ry| | | <n | j | | � n | | } |
|
} | d d k r&i | d d 6| d d 6| |
<g } | d rx1 | d D]" } | | k r�| j | � q�q�Wn | | |
d <n Wq�t k
rI} t j | � q�Xq�Wt | j � d d � d t �}! t | j � d d � d t �}" i | d 6|! d 6|" d! 6| d" 6| d# 6| d$ 6| d% 6}# |# S(& Ns /statusR RA t RssAnoni����i i i t Namet Pidt RssFilet RssShmemt VmRSSs /cmdlinet t t cmdlinet memcgt
ContainerInfoR} t ProcessTypet namespaceR� R� R� t leak_socket_inodesR^ c S s | d | d f S( Ni i ( ( t kv( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt <lambda>^ s t reversec S s | d | d f S( Ni i ( ( R� ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyR� b s t taskInfot taskSortedByAnont taskSortedByVmRsst
filePidMapt
socketInfot taskSocketst namespaceSockstat( RI RC RJ R. t is_numberRV RO Ry RR RS t get_container_infosRP R� R& R' RL t findR( R) R* R1 R~ t replacet get_memcg_by_pidR� Rz Rx t updateR[ t sortedt items($ R� t rootR� t taskMemt taskAnonR� R� R� t net_namespace_net_info_mapt pid_net_namespace_mapRM t net_namespace_idRU t pid_socket_scan_resultt container_infosR� R6 Rv R7 R8 t taskR9 R_ R^ t valueR� t cmdline_fileR� R� t namespace_sockstatt scan_resultt leak_inodesR> R� R� t res( R� ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt collect_task_info� s�
&
s /proc/t
enable_podt podDetectt pod_infot
containerst cgroup_roott CgroupParentRA R� t
ContainerNamet ContainerCgroup( t PluginCollectInfoR. RH R� R3 Rz t get_collect_infot loadR� t storeRI RK ( R� t contextR� t collect_infoR� R� R� R� R� R� t
pod_cgroupt pod_nameR� t containert con_namet
con_cgroupR^ ( ( R� s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt collect� s2 �
c C s d S( N( RP ( R� R� ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt analysis� s ( t __name__t
__module__t __doc__R� R� R� R� ( ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyR� s s
8 �( RI R+ R. t
plugin_systemR4 R2 RD Rz RO RV Rx R� t plugint plugin_pod_supportt
PluginBaseR� ( ( ( s; /usr/local/sysak/.sysak_components/tools/plugin_taskProc.pyt <module> s:
� L &