setroubleshootd进程引起内存不足，selinux导致zabbix_agent没有权限

最新推荐文章于 2025-07-24 16:38:03 发布

原创最新推荐文章于 2025-07-24 16:38:03 发布 · 3.2k 阅读

10 ·

CC 4.0 BY-SA版权

文章标签：

#setroubleshootd #zabbix_agent

运维专栏收录该内容

1 篇文章

订阅专栏

本文描述了在运行Zabbix Agent时遇到的SELinux权限问题，导致setroubleshootd进程内存占用过高。通过ausearch和audit2allow命令找到问题根源，并创建自定义的SELinux策略包来允许Zabbix Agent读取文件和获取状态信息，最后激活策略包解决问题。

问题现象

top查看进程

setroubleshootd内存使用率会到90%以上

查看message日志

[root@L-DB-128-104 ~]# tail -220f /var/log/messages
Apr 26 09:48:45 L-DB-128-104 setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l f8f36d26-e88b-4a2b-9b19-7a9bef751202
Apr 26 09:48:45 L-DB-128-104 setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l f8f36d26-e88b-4a2b-9b19-7a9bef751202
Apr 26 09:48:45 L-DB-128-104 setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from getattr access on the file /proc/<pid>/status. For complete SELinux messages. run sealert -l 82a06995-e8f8-43a1-894e-61e40a36d9db
Apr 26 09:48:45 L-DB-128-104 setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l cbbf5d0f-46c6-403e-b02e-59c1a0d1a859
Apr 26 09:48:45 L-DB-128-104 setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l cbbf5d0f-46c6-403e-b02e-59c1a0d1a859

处理方法

# ausearch -c 'zabbix_agentd' --raw | audit2allow -M my-zabbixagentd
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-zabbixagentd.pp

# semodule -i my-zabbixagentd.pp