deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-15 14:57:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Addressed the comments

Browse Source
This commit is contained in:
Ananta Gupta 2020-03-27 10:43:14 +05:30
parent bda280c12d
commit a16bd060c5
1 changed files with 25 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md
View File

@ -37,63 +37,69 @@ An output from the previous command with correct date and time indicates success
Check if the daemon is running: Check if the daemon is running:
```bash ```bash
$ ps aux | grep wdavdaemon $ systemctl status mdatp
root 1966 0.2 0.8 1068244 82492 ? Ssl 10:37 0:24 /opt/microsoft/mdatp/sbin/wdavdaemon ● mdatp.service - Microsoft Defender ATP
mdatp 1967 0.0 3.7 1133040 373652 ? Sl 10:37 0:02 /opt/microsoft/mdatp/sbin/wdavdaemon Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled)
root 1968 0.0 0.2 421316 27048 ? Sl 10:37 0:00 /opt/microsoft/mdatp/sbin/wdavdaemon Active: active (running) since Thu 2020-03-26 10:37:30 IST; 23h ago
Main PID: 1966 (wdavdaemon)
Tasks: 105 (limit: 4915)
CGroup: /system.slice/mdatp.service
├─1966 /opt/microsoft/mdatp/sbin/wdavdaemon
├─1967 /opt/microsoft/mdatp/sbin/wdavdaemon
└─1968 /opt/microsoft/mdatp/sbin/wdavdaemon
``` ```
## Steps to troubleshoot if wdavdaemon is not running ## Steps to troubleshoot if wdavdaemon is not running
- Check if “mdatp” user exists: 1. Check if “mdatp” user exists:
```bash ```bash
$ id “mdatp” $ id “mdatp”
``` ```
If there’s no output, run If there’s no output, run
```bash ```bash
$ useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp $ sudo useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp
``` ```
- Try enabling and restarting the service using: 2. Try enabling and restarting the service using:
```bash ```bash
$ systemctl enable mdatp $ sudo systemctl enable mdatp
$ systemctl restart mdatp $ sudo systemctl restart mdatp
``` ```
- If mdatp.service is not found upon running the previous command, run 3. If mdatp.service is not found upon running the previous command, run
```bash ```bash
$ cp /opt/microsoft/mdatp/conf/mdatp.service <systemd_path> $ sudo cp /opt/microsoft/mdatp/conf/mdatp.service <systemd_path>
where <systemd_path> is where <systemd_path> is
lib/systemd/system for Ubuntu and Debian distributions /lib/systemd/system for Ubuntu and Debian distributions
/usr/lib/systemd/system for Rhel, CentOS, Oracle and SLES /usr/lib/systemd/system for Rhel, CentOS, Oracle and SLES
``` ```
and then re-run step 2. and then re-run step 2.
- If the above steps don’t work, try disabling SELinux, and then starting the service using step 2. Please re-enable immediately though for security reasons after trying this. 4. If the above steps don’t work, try disabling SELinux, and then starting the service using step 2. Please re-enable immediately though for security reasons after trying this.
- Ensure that the filesystem containing wdavdaemon should not be mounted with “noexec” 5. Ensure that the filesystem containing wdavdaemon is not mounted with “noexec”
## If wdavdaemon is running but eicar detection doesn't work ## If wdavdaemon is running but eicar detection doesn't work
- Check the filesystem type using: 1. Check the filesystem type using:
```bash ```bash
$ mount $ mount
``` ```
Currently supported filesystems for on-access activity are ext2, ext3, ext4, temps, btrfs and xfs. Any files outside these filesystems will not be scanned. Currently supported filesystems for on-access activity are ext2, ext3, ext4, temps, btrfs and xfs. Any files outside these filesystems will not be scanned.
- Collect diagnostic logs: 2. Collect diagnostic logs:
```bash ```bash
$ mdatp --diagnostic --create $ mdatp --diagnostic --create
``` ```
## Command line tool “mdatp” is not working ## Command line tool “mdatp” is not working
- If running the command line tool `mdatp` gives an error `command not found`, run the following: 1. If running the command line tool `mdatp` gives an error `command not found`, run the following:
```bash ```bash
$ ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp $ sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp
``` ```
and try again. and try again.
- If step 1 doesn't work, please collect the diagnostic logs as indicated in the previous section. 2. If step 1 doesn't work, please collect the diagnostic logs as indicated in the previous section.