Abnormal kernel logs and reboot occur in Deep Security Virtual Appliance with Anti-Malware feature

最新推荐文章于 2024-04-03 15:30:52 发布

转载最新推荐文章于 2024-04-03 15:30:52 发布 · 810 阅读

CC 4.0 BY-SA版权

原文链接：https://success.trendmicro.com/solution/1120298-abnormal-kernel-logs-and-reboot-occur-in-deep-security-virtual-appliance-with-anti-malware-feature#

Linux 专栏收录该内容

325 篇文章

订阅专栏

本文详细描述了在使用DeepSecurity虚拟设备的反恶意软件功能时遇到的内核日志异常和频繁重启问题，主要原因是DeepSecurity RTS与CAControl同时访问同一低级系统资源导致。文章提供了具体的解决方案，包括创建配置文件、修改参数等步骤。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

SUMMARY

Machines that are using the Anti-Malware feature may encounter issues in kernel logs. In addition, the machine frequently reboots. The reboot occurs due to failure in processing kernel paging request.

DETAILS

The issue happens because both CA ControlMinder and Deep Security RTS (RealTimeScan) access the same low-level system resource. When CA software starts first, Deep Security continuously restarts because the low-level system resource is already allocated. On the other hand, when Deep Security starts before the CA software, the CA software causes the kernel panic.

To resolve the issue:

Create the ds_am.ini file under /var/opt/ds_agent/am/.
Add the following line:
/opt/ds_agent/lib/libvmpd_dsa_rtscan.so=rtscan_hook_enable=1,rtscan_hook_kern_method=1
Restart the ds_agent service.
If the issue persists, change the parameter in Step 2 by modifying its value from "1" to "2" as shown below:
/opt/ds_agent/lib/libvmpd_dsa_rtscan.so=rtscan_hook_enable=1,rtscan_hook_kern_method=2

Whereas:
1 = use redirfs hook only
2 = use syscall hook only
3 = use both; default value

Disabling one of them should be able to avoid the hooking issue while keeping the RTS detection ability.

转载至https://success.trendmicro.com/solution/1120298-abnormal-kernel-logs-and-reboot-occur-in-deep-security-virtual-appliance-with-anti-malware-feature#