install sysdig

[xuan trung bui]

After installation ，

 

#sysdig -c topprocs_net

Unable to load the driver
error opening device /dev/scap0. Make sure you have root credentials and that the scap module is loaded.

[Oscar Fernández Sierra]

I think there is a kernel missing module (sysdig_probe).

In my case, I compiled the sysdig source code (some years ago), and it created a kernel module for my kernel version.

When I run sysdig as root, it loads a module called "sysdig_probe" (at least, that is in my version; I don't know it the module name has changed recently).

After running sysdig and killing it, the module remains loaded:

root@veve0402:/home/oscar# lsmod | grep sysdig
sysdig_probe          180817  0

After finishing using sysdig, I  use to unload that kernel module:

root@veve0402:/home/oscar# modprobe -r sysdig_probe

After unloading it, it isn't in memory:

root@veve0402:/home/oscar# lsmod | grep sysdig

So you can test to load that module manually, and watch for errors. In my  case, there is no error:

root@veve0402:/home/oscar# modprobe sysdig_probe
root@veve0402:/home/oscar# lsmod | grep sysdig
sysdig_probe          180817  0

One reason for the error could be that you have update the kernel version, and you forget to recompile the sysdig kernell module.

Kind regards,

Oscar

[Salman Khwaja]

Hi, 

I am getting this error. 

[root@master-1 bin]# modprobe sysdig_probe
modprobe: FATAL: Module sysdig_probe not found in directory /lib/modules/4.18.0-408.el8.x86_64

What should I be doing. ? 

[Salman Khwaja]

Moving onto installing SCAP (Security Content Automation Protocol)

# yum -y install openscap-scanner scap-security-guide

https://www.server-world.info/en/note?os=CentOS_7&p=openscap&f=1