A Pod named tomcat123 is suspected of generating and executing anomalous processes. Runtime detection tools are required to analyze this behavior.

The tools sysdig and falco are available, but they are only installed on the worker node node02. Analysis must run for at least 30 seconds. Use filters to inspect process generation and exectuion events. Output must be written to a file at /opt/KSR00101/incidents/summary on the worker node. Each event entry should follow the format: timestamp , uid/username , processName. Preserve the tool's original timestamp format.

First, configure the correct cluster context.

kubectl config use-context KSSC00401

Connect to the worker node node02 and switch to the root user.

ssh node02
sudo -i

Identify the container runtime socket. For containerd, use the folloiwng command.

crictl info | grep sock
# Example output:  "socketPath": "/run/containerd/containerd.sock"

Locate the specific container within the tomcat123 Pod. Note the container name, which may differ from the Pod name.

crictl ps | grep tomcat123

Using sysdig, examine the available field formats for timestamp, user ID, and process name.

sysdig -l | grep -E 'time|uid|proc'

Execute sysdig to monitor the container for 30 seconds. Use the container name (e.g., tomcat-container) identified earlier and the appropriate container runtime interface (CRI) socket path. Output events to the required file.

sysdig -M 30 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.name=tomcat-container >> /opt/KSR00101/incidents/summary
sysdig -M 30 -p "%evt.time,%user.name,%proc.name" --cri /run/containerd/containerd.sock container.name=tomcat-container >> /opt/KSR00101/incidents/summary

If sysdig fails with a error loading the driver, load the kernel module and retry.

sysdig-probe-loader

If the issue persists, reinstall the package.

apt update && apt install -y sysdig

Verify the contents of the generated events file.

head /opt/KSR00101/incidents/summary