Yayin da Microsoft ke samar da aikace-aikace da ayyuka da farko tsara don amfani da tsarin ku Windows aiki, a tsawon shekaru kamfanin Ya karɓi ba kawai macOS ba har ma Linux. Bayan ƙaddamar da Windows Subsystem don Linux kwanan nan a cikin kantin sayar da Windows 11, Microsoft ya fito da wani kayan aikin sa don masu amfani da Linux.
Kuma shine Microsoft ya fito da sigar Linux na Sysmon, kayan aiki na tsarin Windows. Sysmon shine kawai ɗaya daga cikin kayan aikin da ke cikin tarin Sysinternals wanda Microsoft ke kula da shi, yana bawa masu amfani damar saka idanu akan tsarin alamun ayyukan da ake tuhuma da za'a iya shiga.
Wannan kayan aiki ne mai daidaitawa wanda masu gudanar da tsarin za su iya keɓancewa don nemo takamaiman nau'ikan ayyuka waɗanda ke da damuwa.
Game da Sysmon System Monitor
Ga waɗanda basu san Sysmon ba, yakamata ku san wannan shiri ne da aka sanya shi azaman sabis na tsarin kuma yana ci gaba da gudana ko da bayan sake kunnawa na gaba.
Yana ba da damar saka idanu da rikodin ayyukan tsarin a cikin log ɗin taron Windows kuma yana ba da cikakkun bayanai kan ƙirƙirar matakai, haɗin yanar gizo, ƙirƙira da gyara fayiloli. Ta hanyar nazarin abubuwan da Sysmon ya haifar akan na'urar da ake amfani da ita, mai gudanarwa zai iya gano ayyukan da ba su da kyau ko na mugunta, fahimtar yadda aka yi amfani da tsarin, fahimtar yadda masu kutse suka yi aiki a tsarin.
Sigar Linux ta Sysmon yayi nisa daga keɓaɓɓen kayan aiki, kuma ya sami kansa yana kokawa don samun kulawa a cikin filin da ya riga ya cika. Koyaya, zaku sami magoya baya tsakanin masu gudanar da tsarin waɗanda suka riga sun yi amfani da Sysmon don Windows kuma suna ɗokin jiran tashar Linux don amfani da wasu tsarin.
Duk wanda ke son farawa da kayan aiki zai buƙaci sanin yadda ake tattara binaries na Linux, amma hakan bai kamata ya zama cikas ga masu sauraron kayan aikin ba. A cikin bikin, Mark Russinovich, mahaliccin kunshin, ya ce Sysinternals yanzu ana iya sauke su ta hanyar winget ko Shagon Microsoft. Hakanan, kamar yadda kuka riga kuka sani, kwanan nan an sake Sysmon don Linux, tare da buɗe lambar tushe.
Yadda ake shigar Sysmon akan Linux?
Sigar Linux tana buƙatar shigar da SysinternalsEBPF sannan a haɗa kayan aikin ta mai amfani. Umarnin don wannan suna kan shafin Sysmon akan GitHub.
Misali, kayan aikin yana da hanyar shigarwa mai sauƙi a cikin Ubuntu, tunda don shigar da shi, kawai buɗe tasha kuma buga:
wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
sudo apt install build-essential gcc g++ make cmake libelf-dev llvm clang libxml2 libxml2-dev libzstd1 git libgtest-dev apt-transport-https dirmngr monodevelop googletest google-mock libjson-glib-dev
sudo apt-get update
sudo apt-get install sysmonforlinux
Yayin da Debian 11:
wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.asc.gpg
sudo mv microsoft.asc.gpg /etc/apt/trusted.gpg.d/
wget -q https://packages.microsoft.com/config/debian/11/prod.list
sudo mv prod.list /etc/apt/sources.list.d/microsoft-prod.list
sudo chown root:root /etc/apt/trusted.gpg.d/microsoft.asc.gpg
sudo chown root:root /etc/apt/sources.list.d/microsoft-prod.list
sudo apt-get update
sudo apt-get install apt-transport-https
sudo apt-get update
sudo apt-get install sysmonforlinux
Ko a cikin yanayin Fedora 34:
sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
sudo wget -q -O /etc/yum.repos.d/microsoft-prod.repo https://packages.microsoft.com/config/fedora/34/prod.repo
sudo dnf install sysmonforlinux
Bayan an gama shigarwa, Sysmon don Linux yana fara ayyukan tsarin shiga / var / log / syslog. Wasu al'amuran da kayan aikin suka shigar ba su shafi Linux ba. Labari mai dadi shine ana iya saita Sysmon don yin rikodin kawai abin da mai gudanarwa ya ga ya dace.
Kuna iya fara shirin kuma ku sami tsarin umarni masu amfani. Don yin wannan, kawai suna rubuta:
sysmon -h
Kuna iya karɓar sharuɗɗan amfani ta hanyar bugawa
sysmon -accepteula
Sysmon kayan aiki ne mai ƙarfi wanda aka daɗe ana amfani da shi a cikin Windows don haskaka abubuwan da ke haifar da mummunan hali da aka gano a matakin aikace-aikacen ko a cikin hanyar sadarwar gida.
Finalmente Idan kuna da sha'awar sanin game da shi, zaka iya duba bayanan A cikin mahaɗin mai zuwa.