Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

Problem

  1. Scan Jobs > specific scan job > Scan Status Tab

  2. Warning:

    1. Status: PartialScan

    2. ScanInfo: Problem while scanning <O/S>. There is one truncated process with the following process ID: [XXXXX]

Description/Solution

In some versions of older Linux O/S, there is a limit on the length of command line returned from commands such as ps. In older O/S this limit can be 1024 characters. It should be possible to improve this by upgrading the O/S version in order to maximise the command line length (typically to 4096 characters - typically called the O/S page size).

Minimum version required to display this maximised number of characters on the command lines, for each O/S

  • Cent OS 6.8 or higher

  • Debian 9 (Stretch)

  • Oracle Linux Server OL6U8 or higher

  • Fedora 23 or higher

  • RHEL 6.8 or higher

  • Ubuntu 15.10 or higher

  • In Suse, a version that uses a kernel version 4.2 or higher

The reason that this limit is problematic is that the identification of running applications (called ‘finger-printing’ within CAM) is based on using this name of the application that is running. If the command line text is truncated, some of this information is missing and finger-printing cannot be executed correctly.

Example Truncated Output

/lo/active/jdk1.6.0_22/bin/java -server 
-Djava.awt.headless=true -Xdebug -Xrunjdwp:transport=dt_socket,address=localhost:4001,server=y,suspend=n 
-classpath /lo/active/presence/../java/build:../java/build/lib/NagiosAppender-1.5.0.jar:../java/build/lib/activation-1.1.jar:
    ../java/build/lib/activemq-console-5.3.0.4-fuse.jar:../java/build/lib/activemq-core-5.3.0.4-fuse-tests.jar:../java/build/lib/activemq-core-5.3.0.4-fuse.jar:
    ../java/build/lib/activemq-jaas-5.3.0.4-fuse.jar:../java/build/lib/activemq-web-5.3.0.4-fuse.jar:../java/build/lib/axis.jar:../java/build/lib/commons-cli-1.0.jar:
    ../java/build/lib/commons-codec-1.3.jar:../java/build/lib/commons-collections-3.2.jar:../java/build/lib/commons-dbcp-1.4.jar:../java/build/lib/commons-discovery.jar:
    ../java/build/lib/commons-fileupload-1.2.1.jar:../java/build/lib/commons-httpclient-3.1.jar:../java/build/lib/commons-logging.jar:../java/build/lib/commons-pool-1.3.jar:
    ../java/build/lib/dnsjava-2.0.1.jar:../java/build/lib/gator.jar:../java/build/lib/geronimo-j2ee-management_1.0_spec-1.0.jar:
    ../java/build/lib/geronimo-jms_1.1_spec-1.0.jar:../java/build/lib/geronimo-jta_1.0.1B_spec-1.0.jar:../java/build/lib/jaxrpc.jar:
    ../java/build/lib/jetty-6.1.19.jar:../java/build/lib/jetty-util-6.1.19.jar:../java/build/lib/js.jar:../java/build/lib/json.jar:
    ../java/build/lib/jvyaml.jar:../java/build/lib/jyaml-1.3.jar:../java/build/lib/log4j-1.2.15.jar:../java/build/lib/logger-api-src.jar:
    ../java/build/lib/logger-api.jar:../java/build/lib/mysql-connector-java-3.1.14-bin.jar:../java/build/lib/saaj.jar:
    ../java/build/lib/servlet-api-2.5-20081211.jar:../java/build/lib/syslog.jar:../java/build/lib/wsdl4j.jar:../java/build/lib/xerces.jar:
    ../java/build/lib/IngrianLog4j.jar:../java/build/lib/IngrianNAE-5.0.0.jar::lo-presence-3.0.6.jar:/lo/active/presence/lib/activation-1.1.jar:
    /lo/active/presence/lib/activeio-core-3.1.0.jar:/lo/active/presence/lib/activemq-core-5.2.0.jar:/lo/active/presence/lib/axis-1.4.jar:
    /lo/active/presence/lib/axis-jaxrpc-1.4.jar:/lo/active/presence/lib/axis-saaj-1.4.jar:/lo/active/presence/lib/axis-wsdl4j-1.5.1.jar:
    /lo/active/presence/lib/backport-util-concurrent-2.1.jar:/lo/active/presence/lib/bayeux-api-2.4.0.jar:/lo/active/presence/lib/camel-core-1.5.0.jar:
    /lo/active/presence/lib/cometd-java-annotations-2.4.0.jar:/lo/active/presence/lib/cometd-java-client-2.4.0.jar:/lo/active/presence/lib/cometd-java-common-2.4.0.jar:
    /lo/active/presence/lib/cometd-java-server-2.4.0.jar:/lo/active/presence/lib/commons-cli-1.0.jar:/lo/active/presence/lib/commons-codec-1.4.jar:
    /lo/active/presence/lib/commons-dbcp-1.4.jar:/lo/active/presence/lib/commons-discovery-0.2.jar:/lo/active/presence/lib/commons-lang-1.0.jar:
    /lo/active/presence/lib/commons-logging-1.1.1.jar:/lo/active/presence/lib/commons-logging-api-1.1.jar:/lo/active/presence/lib/commons-pool-1.5.4.jar:
    /lo/active/presence/lib/dnsjava-2.0.1.jar:/lo/active/presence/lib/gator-1.0.0.jar:/lo/active/presence/lib/geronimo-j2ee-management_1.0_spec-1.0.jar:
    /lo/active/presence/lib/geronimo-jms_1.1_spec-1.1.1.jar:/lo/active/presence/lib/httpclient-4.1.1.jar:/lo/active/presence/lib/httpcore-4.1.jar:
    /lo/active/presence/lib/IngrianLog4j-5.0.0.jar:/lo/active/presence/lib/IngrianNAE-5.0.0.jar:/lo/active/presence/lib/javassist-3.10.0.GA.jar:
    /lo/active/presence/lib/javax.inject-1.jar:/lo/active/presence/lib/jetty-client-7.6.0.v20120127.jar:/lo/active/presence/lib/jetty-continuation-7.6.0.v20120127.jar:
    /lo/active/presence/lib/jetty-http-7.6.0.v20120127.jar:/lo/active/presence/lib/jetty-io-7.6.0.v20120127.jar:/lo/active/presence/lib/jetty-jmx-7.6.0.v20120127.jar:
    /lo/active/presence/lib/jetty-security-7.6.0.v20120127.jar:/lo/active/presence/lib/jetty-server-7.6.0.v20120127.jar:
    /lo/active/presence/lib/jetty-servlet-7.6.0.v20120127.jar:/lo/active/presence/lib/jetty-servlets-7.6.0.v20120127.jar:
    /lo/active/presence/lib/jetty-util-7.6.0.v20120127.jar:/lo/active/presence/lib/jms-1.1.jar:/lo/active/presence/lib/jmxri-1.2.1.jar:
    /lo/active/presence/lib/jmxtools-1.2.1.jar:/lo/active/presence/lib/js-1.7R1XD.jar:/lo/active/presence/lib/json-20090211.jar:/lo/active/presence/lib
 < missing data is here >

Future Developments

As can be seen from the example above, the presence of the java CLASSPATH value, the command line that is generated can be extremely long. CloudSphere is investigating additional approaches that could be used to improve CAM’s ability to identify and fingerprint processes with extremely long lines.

  • No labels