首先是明面上有的卸载脚本:
sudo /usr/local/qcloud/stargate/admin/uninstall.shsudo /usr/local/qcloud/monitor/barad/admin/uninstall.sh
然后是藏起来的自动化助手:
cd /tmp && mkdir tmp && cd tmp && wget https://tat-gz-1258344699.cos.ap-guangzhou.myqcloud.com/tat_agent_linux_x86_64.zip && unzip tat_agent_linux_x86_64.zip && ./uninstall.sh
最后是最神秘的 secu-tcs-agent
。首先先把维持它运转的 crontab
和 rc.local
清一下:
sudo vim /var/spool/cron/crontabs/rootsudo vim /etc/rc.d/rc.local
删除这两个文件的对应部分,默认是最后两行。然后 root
执行下面的脚本:
#!/bin/bash###ver=5.0.0
PATH="/usr/local/bin:/usr/bin:/sbin:/usr/X11R6/bin:/usr/sbin:/bin:/usr/games"export PATH
# 20%CPU_LIMIT=2000# uint: KB, 50MRSS_LIMIT=51200
SCRIPT_PATH=/usr/local/sa/agent/kill.shBASE_DIR=/usr/local/sa/agent
PROC_NAME=secu-tcs-agent
PS_INFO=$BASE_DIR/secubase/secu-tcs-ps.infoMON_LOG=$BASE_DIR/secubase/secu-tcs-ps.logLIMIT_FILE=$BASE_DIR/secubase/secu-tcs-ps.lmtRESTART_FILE=$BASE_DIR/secubase/secu-tcs-restart.cnt
# 检查日志, 如果大小超过限制就删除if [ -e ${MON_LOG} ]; then LOG_FILE_SIZE=`stat --format=%s ${MON_LOG}` # limit 10K if [ $LOG_FILE_SIZE -gt 10240 ]; then rm -f ${MON_LOG} fifi
# 获取pid为1的进程的mnt namespace inodePID1_MNT_NS_INODE=""if [ -L /proc/1/ns/mnt ]; then PID1_MNT_NS_INODE=$(readlink /proc/1/ns/mnt)fi
function DoLog(){ CUR_TIME=`date +"%Y-%m-%d %H:%M:%S"` echo "[$CUR_TIME] $1" >> $MON_LOG}
function DoStop(){ if [ -z "$PID1_MNT_NS_INODE" ]; then LIST_WATCH_DOG_PID=`ps -efw | grep "watchdog\.sh" | grep $BASE_DIR | grep -v grep | awk -F ' ' '{print $2}'` for watchdog_pid in $LIST_WATCH_DOG_PID do kill -9 $watchdog_pid done
LIST_AGENT_PID=`ps -efw | grep -E "${PROC_NAME}($|[[:space:]]+)" | grep $BASE_DIR | grep -v grep | awk -F ' ' '{print $2}'` for agent_pid in $LIST_AGENT_PID do kill -9 $agent_pid done else LIST_WATCH_DOG_PID=`ps -efw | grep "watchdog\.sh" | grep $BASE_DIR | grep -v grep | awk -F ' ' '{print $2}'` for watchdog_pid in $LIST_WATCH_DOG_PID do WATCHDOG_MNT_NS_INODE=$(readlink /proc/${watchdog_pid}/ns/mnt) if [ "$WATCHDOG_MNT_NS_INODE" = "$PID1_MNT_NS_INODE" ]; then kill -9 $watchdog_pid fi done
LIST_AGENT_PID=`ps -efw | grep -E "${PROC_NAME}($|[[:space:]]+)" | grep $BASE_DIR | grep -v grep | awk -F ' ' '{print $2}'` for agent_pid in $LIST_AGENT_PID do AGENT_MNT_NS_INODE=$(readlink /proc/${agent_pid}/ns/mnt) if [ "$AGENT_MNT_NS_INODE" = "$PID1_MNT_NS_INODE" ]; then kill -9 $agent_pid fi done fi}
DoStop
最后移除这两个目录:
sudo rm -rf /usr/local/qcloud/sudo rm -rf /usr/local/sa/
終わり!