![防火墙无故停止](https://linux22.com/image/782905/%E9%98%B2%E7%81%AB%E5%A2%99%E6%97%A0%E6%95%85%E5%81%9C%E6%AD%A2.png)
我有一台 Red Hat 8 服务器。我曾经在firewall-cmd --permanent --zone=public --add-service=https
服务器上启用了到服务器的公共流量。当我 时systemctl start firewalld
,它按预期工作。但是,每隔 10 分钟左右,守护进程就会停止。我自己没有这样做,所以我假设 的其他部分systemd
正在这样做。以下是 的输出journalctl --unit firewalld --pager-end
。值得注意的是,启动和停止之间的时间有时超过 10 分钟,因此无论发生什么,都不会每 10 分钟精确发生一次:
Dec 27 22:12:53 my.server.domain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 27 22:12:53 my.server.domain systemd[1]: Started firewalld - dynamic firewall daemon.
Dec 27 22:12:53 my.server.domain firewalld[165220]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please conside>
Dec 27 22:38:50 my.server.domain systemd[1]: Stopping firewalld - dynamic firewall daemon...
Dec 27 22:38:50 my.server.domain systemd[1]: firewalld.service: Succeeded.
Dec 27 22:38:50 my.server.domain systemd[1]: Stopped firewalld - dynamic firewall daemon.
Dec 27 23:16:34 my.server.domain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 27 23:16:34 my.server.domain systemd[1]: Started firewalld - dynamic firewall daemon.
Dec 27 23:16:35 my.server.domain firewalld[486273]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please conside>
Dec 27 23:38:49 my.server.domain systemd[1]: Stopping firewalld - dynamic firewall daemon...
Dec 27 23:38:50 my.server.domain systemd[1]: firewalld.service: Succeeded.
Dec 27 23:38:50 my.server.domain systemd[1]: Stopped firewalld - dynamic firewall daemon.
Dec 28 02:59:38 my.server.domain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 28 02:59:39 my.server.domain systemd[1]: Started firewalld - dynamic firewall daemon.
Dec 28 02:59:39 my.server.domain firewalld[1607080]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consid>
Dec 28 03:08:50 my.server.domain systemd[1]: Stopping firewalld - dynamic firewall daemon...
Dec 28 03:08:51 my.server.domain systemd[1]: firewalld.service: Succeeded.
Dec 28 03:08:51 my.server.domain systemd[1]: Stopped firewalld - dynamic firewall daemon.
Dec 28 03:29:19 my.server.domain systemd[1]: Starting firewalld - dynamic firewall daemon...
Dec 28 03:29:19 my.server.domain systemd[1]: Started firewalld - dynamic firewall daemon.
Dec 28 03:29:19 my.server.domain firewalld[1760864]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consid>
Dec 28 03:38:49 my.server.domain systemd[1]: Stopping firewalld - dynamic firewall daemon...
Dec 28 03:38:49 my.server.domain systemd[1]: firewalld.service: Succeeded.
Dec 28 03:38:49 my.server.domain systemd[1]: Stopped firewalld - dynamic firewall daemon.
为什么会发生这种情况?我该如何确保它firewalld
始终保持活跃?
答案1
我发现调试此问题最有用的工具是journalctl --pager-end --output with-unit
。它为您提供所有单元的输出,但单元生成的每个日志都有标签。然后,当我搜索防火墙停止的日志时,我发现了以下内容:
Wed 2022-12-28 18:38:49 AEDT my.domain init.scope[1]: Stopping firewalld - dynamic firewall daemon...
Wed 2022-12-28 18:38:50 AEDT my.domain init.scope[1]: firewalld.service: Succeeded.
Wed 2022-12-28 18:38:50 AEDT my.domain init.scope[1]: Stopped firewalld - dynamic firewall daemon.
Wed 2022-12-28 18:38:50 AEDT my.domain puppet.service[2003956]: (/Stage[main]/Firewall::Linux::Redhat/Service[firewalld]/ensure) ensure changed 'running' to 'stopped' (corrective)
所以发生的事情是puppet
安装了它,它试图定期“纠正”我对防火墙的更改,我想象使用类似这样的配方:https://www.puppetcookbook.com/posts/ensure-service-is-stopped.html。
因此,我能够使用 解决我的问题systemctl disable puppet && systemctl stop puppet
。