mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge pull request #7023 from jdmartinez36/jdmartinez36-linux-branch
[DO NOT MERGE] Edits for linux support articles
This commit is contained in:
Tina Burden
GitHub
commit
734b9d9524
@ -33,7 +33,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux using Puppet
|
||||
|
||||
## Prerequisites and system requirements
|
||||
|
||||
Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version.
|
||||
For a description of prerequisites and system requirements for the current software version, see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md).
|
||||
|
||||
In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules, such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details.
|
||||
|
||||
@ -205,7 +205,7 @@ If the product is not healthy, the exit code (which can be checked through `echo
|
||||
|
||||
## Log installation issues
|
||||
|
||||
See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
|
||||
For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
|
||||
|
||||
## Operating system upgrades
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https:
|
||||
|
||||
The output from this command should be similar to:
|
||||
|
||||
```
|
||||
```bash
|
||||
OK https://x.cp.wd.microsoft.com/api/report
|
||||
OK https://cdn.x.cp.wd.microsoft.com/ping
|
||||
```
|
||||
|
||||
@ -27,23 +27,26 @@ ms.topic: conceptual
|
||||
## Verify if installation succeeded
|
||||
|
||||
An error in installation may or may not result in a meaningful error message by the package manager. To verify if the installation succeeded, one can obtain and check the installation logs using:
|
||||
```bash
|
||||
$ sudo journalctl | grep 'microsoft-mdatp' > installation.log
|
||||
$ grep 'postinstall end' installation.log
|
||||
|
||||
microsoft-mdatp-installer[102243]: postinstall end [2020-03-26 07:04:43OURCE +0000] 102216
|
||||
```
|
||||
```bash
|
||||
$ sudo journalctl | grep 'microsoft-mdatp' > installation.log
|
||||
$ grep 'postinstall end' installation.log
|
||||
|
||||
microsoft-mdatp-installer[102243]: postinstall end [2020-03-26 07:04:43OURCE +0000] 102216
|
||||
```
|
||||
|
||||
An output from the previous command with correct date and time of installation indicates success.
|
||||
|
||||
Also check the [Client configuration](linux-install-manually.md#client-configuration) to verify the health of the product and detect the EICAR text file.
|
||||
|
||||
## Installation failed
|
||||
|
||||
Check if the mdatp service is running
|
||||
```bash
|
||||
$ systemctl status mdatp
|
||||
Check if the mdatp service is running:
|
||||
|
||||
● mdatp.service - Microsoft Defender ATP
|
||||
```bash
|
||||
$ systemctl status mdatp
|
||||
|
||||
● mdatp.service - Microsoft Defender ATP
|
||||
Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Thu 2020-03-26 10:37:30 IST; 23h ago
|
||||
Main PID: 1966 (wdavdaemon)
|
||||
@ -52,71 +55,71 @@ $ systemctl status mdatp
|
||||
├─1966 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
├─1967 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
└─1968 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
```
|
||||
|
||||
## Steps to troubleshoot if mdatp service isn't running
|
||||
|
||||
1. Check if “mdatp” user exists:
|
||||
```bash
|
||||
$ id “mdatp”
|
||||
```
|
||||
If there’s no output, run
|
||||
```bash
|
||||
$ sudo useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp
|
||||
```
|
||||
1. Check if "mdatp" user exists:
|
||||
```bash
|
||||
$ id "mdatp"
|
||||
```
|
||||
If there’s no output, run
|
||||
```bash
|
||||
$ sudo useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp
|
||||
```
|
||||
|
||||
2. Try enabling and restarting the service using:
|
||||
```bash
|
||||
$ sudo systemctl enable mdatp
|
||||
$ sudo systemctl restart mdatp
|
||||
```
|
||||
```bash
|
||||
$ sudo systemctl enable mdatp
|
||||
$ sudo systemctl restart mdatp
|
||||
```
|
||||
|
||||
3. If mdatp.service isn't found upon running the previous command, run
|
||||
```bash
|
||||
$ sudo cp /opt/microsoft/mdatp/conf/mdatp.service <systemd_path>
|
||||
```bash
|
||||
$ sudo cp /opt/microsoft/mdatp/conf/mdatp.service <systemd_path>
|
||||
|
||||
where <systemd_path> is
|
||||
/lib/systemd/system for Ubuntu and Debian distributions
|
||||
/usr/lib/systemd/system for Rhel, CentOS, Oracle and SLES
|
||||
```
|
||||
and then rerun step 2.
|
||||
where <systemd_path> is
|
||||
/lib/systemd/system for Ubuntu and Debian distributions
|
||||
/usr/lib/systemd/system for Rhel, CentOS, Oracle and SLES
|
||||
```
|
||||
and then rerun step 2.
|
||||
|
||||
4. If the above steps don’t work, check if SELinux is installed and in enforcing mode. If so, try setting it to permissive (preferably) or disabled mode. It can be done by setting the parameter `SELINUX` to "permissive" or "disabled" in `/etc/selinux/config` file, followed by reboot. Check the man-page of selinux for more details.
|
||||
Now try restarting the mdatp service using step 2. Revert the configuration change immediately though for security reasons after trying it and reboot.
|
||||
|
||||
5. Ensure that the daemon has executable permission.
|
||||
```bash
|
||||
$ ls -l /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```bash
|
||||
$ ls -l /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
|
||||
-rwxr-xr-x 2 root root 15502160 Mar 3 04:47 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
If the daemon doesn't have executable permissions, make it executable using:
|
||||
```bash
|
||||
$ sudo chmod 0755 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
and retry running step 2.
|
||||
-rwxr-xr-x 2 root root 15502160 Mar 3 04:47 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
If the daemon doesn't have executable permissions, make it executable using:
|
||||
```bash
|
||||
$ sudo chmod 0755 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
and retry running step 2.
|
||||
|
||||
6. Ensure that the file system containing wdavdaemon isn't mounted with “noexec”.
|
||||
6. Ensure that the file system containing wdavdaemon isn't mounted with "noexec".
|
||||
|
||||
## If mdatp service is running, but EICAR text file detection doesn't work
|
||||
|
||||
1. Check the file system type using:
|
||||
```bash
|
||||
$ findmnt -T <path_of_EICAR_file>
|
||||
```
|
||||
Currently supported file systems for on-access activity are listed [here](microsoft-defender-atp-linux.md#system-requirements). Any files outside these file systems won't be scanned.
|
||||
```bash
|
||||
$ findmnt -T <path_of_EICAR_file>
|
||||
```
|
||||
Currently supported file systems for on-access activity are listed [here](microsoft-defender-atp-linux.md#system-requirements). Any files outside these file systems won't be scanned.
|
||||
|
||||
## Command-line tool “mdatp” isn't working
|
||||
|
||||
1. If running the command-line tool `mdatp` gives an error `command not found`, run the following command:
|
||||
```bash
|
||||
$ sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp
|
||||
```
|
||||
and try again.
|
||||
```bash
|
||||
$ sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp
|
||||
```
|
||||
and try again.
|
||||
|
||||
If none of the above steps help, collect the diagnostic logs:
|
||||
```bash
|
||||
$ sudo mdatp diagnostic create
|
||||
Diagnostic file created: <path to file>
|
||||
```
|
||||
Path to a zip file that contains the logs will be displayed as an output. Reach out to our customer support with these logs.
|
||||
If none of the above steps help, collect the diagnostic logs:
|
||||
```bash
|
||||
$ sudo mdatp diagnostic create
|
||||
Diagnostic file created: <path to file>
|
||||
```
|
||||
Path to a zip file that contains the logs will be displayed as an output. Reach out to our customer support with these logs.
|
||||
|
||||
@ -81,4 +81,4 @@ The following steps can be used to troubleshoot and mitigate these issues:
|
||||
|
||||
4. Configure Microsoft Defender ATP for Linux with exclusions for the processes or disk locations that contribute to the performance issues and re-enable real-time protection.
|
||||
|
||||
See [Configure and validate exclusions for Microsoft Defender ATP for Linux](linux-exclusions.md) for details.
|
||||
For more details, see [Configure and validate exclusions for Microsoft Defender ATP for Linux](linux-exclusions.md).
|
||||
|
||||
@ -27,7 +27,7 @@ ms.topic: conceptual
|
||||
## 101.00.75
|
||||
|
||||
- Added support for the following file system types: `ecryptfs`, `fuse`, `fuseblk`, `jfs`, `nfs`, `overlay`, `ramfs`, `reiserfs`, `udf`, and `vfat`
|
||||
- New syntax for the command-line tool. For more information, see [this page](linux-resources.md#configure-from-the-command-line).
|
||||
- New syntax for the [command-line tool](linux-resources.md#configure-from-the-command-line).
|
||||
- Performance improvements & bug fixes
|
||||
|
||||
## 100.90.70
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user