LeakIX - Host 38.98.222.47

Host 38.98.222.47

United States

COGENT-174

CheckMK monitoring endpoint publicly available

An open CheckMK agent is publicly available.

This could leak sensitive information such as :

Process list ( maybe credentials )
Network interfaces
Running services
Firewall rules
Internal OS configuration

https://docs.checkmk.com/latest/en/wato_monitoringagents.html

IP: 38.98.222.47
Port: 6556

First seen 2022-09-28 13:54
Last seen 2024-12-22 00:58
Open for 815 days

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79399afc5742

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:40:18/1658-02:21:14,1) /sbin/init
(root,0,0,00:00:05/1658-02:21:14,2) [kthreadd]
(root,0,0,00:15:19/1658-02:21:14,3) [migration/0]
(root,0,0,00:13:38/1658-02:21:14,4) [ksoftirqd/0]
(root,0,0,00:00:00/1658-02:21:14,5) [stopper/0]
(root,0,0,00:04:20/1658-02:21:14,6) [watchdog/0]
(root,0,0,00:23:17/1658-02:21:14,7) [migration/1]
(root,0,0,00:00:00/1658-02:21:14,8) [stopper/1]
(root,0,0,00:07:51/1658-02:21:14,9) [ksoftirqd/1]
(root,0,0,00:04:02/1658-02:21:14,10) [watchdog/1]
(root,0,0,02:57:45/1658-02:21:14,11) [events/0]
(root,0,0,03:09:53/1658-02:21:14,12) [events/1]
(root,0,0,00:00:00/1658-02:21:14,13) [cgroup]
(root,0,0,00:00:00/1658-02:21:14,14) [khelper]
(root,0,0,00:00:00/1658-02:21:14,15) [netns]
(root,0,0,00:00:00/1658-02:21:14,16) [async/mgr]
(root,0,0,00:00:00/1658-02:21:14,17) [pm]
(root,0,0,00:00:00/1658-02:21:14,18) [xenwatch]
(root,0,0,00:00:00/1658-02:21:14,19) [xenbus]
(root,0,0,00:09:29/1658-02:21:14,20) [sync_supers]
(root,0,0,00:11:15/1658-02:21:14,21) [bdi-default]
(root,0,0,00:00:00/1658-02:21:14,22) [kintegrityd/0]
(root,0,0,00:00:00/1658-02:21:14,23) [kintegrityd/1]
(root,0,0,00:09:58/1658-02:21:14,24) [kblockd/0]
(root,0,0,00:01:54/1658-02:21:14,25) [kblockd/1]
(root,0,0,00:00:00/1658-02:21:14,26) [ata_aux]
(root,0,0,00:00:00/1658-02:21:14,27) [ata_sff/0]
(root,0,0,00:00:00/1658-02:21:14,28) [ata_sff/1]
(root,0,0,00:00:00/1658-02:21:14,29) [ksuspend_usbd]
(root,0,0,00:00:00/1658-02:21:14,30) [khubd]
(root,0,0,00:00:00/1658-02:21:14,31) [kseriod]
(root,0,0,00:00:00/1658-02:21:14,32) [md/0]
(root,0,0,00:00:00/1658-02:21:14,33) [md/1]
(root,0,0,00:00:00/1658-02:21:14,34) [md_misc/0]
(root,0,0,00:00:00/1658-02:21:14,35) [md_misc/1]
(root,0,0,00:00:00/1658-02:21:14,36) [linkwatch]
(root,0,0,00:00:54/1658-02:21:14,37) [khungtaskd]
(root,0,0,00:00:09/1658-02:21:14,38) [kswapd0]
(root,0,0,00:00:00/1658-02:21:14,39) [ksmd]
(root,0,0,00:00:00/1658-02:21:14,40) [aio/0]
(root,0,0,00:00:00/1658-02:21:14,41) [aio/1]
(root,0,0,00:00:00/1658-02:21:14,42) [crypto/0]
(root,0,0,00:00:00/1658-02:21:14,43) [crypto/1]
(root,0,0,00:00:00/1658-02:21:14,51) [kthrotld/0]
(root,0,0,00:00:00/1658-02:21:14,52) [kthrotld/1]
(root,0,0,00:00:00/1658-02:21:14,54) [khvcd]
(root,0,0,00:00:00/1658-02:21:14,55) [kpsmoused]
(root,0,0,00:00:00/1658-02:21:14,56) [usbhid_resumer]
(root,0,0,00:00:00/1658-02:21:14,57) [deferwq]
(root,0,0,00:00:00/1658-02:21:14,89) [kdmremove]
(root,0,0,00:00:00/1658-02:21:14,90) [kstriped]
(root,0,0,00:00:00/1658-02:21:09,233) [kdmflush]
(root,0,0,00:00:00/1658-02:21:09,235) [kdmflush]
(root,0,0,00:00:30/1658-02:20:56,252) [kjournald]
(root,10936,368,00:00:00/1658-02:20:36,341) /sbin/udevd -d
(apache,613336,211796,00:00:00/5-18:41:34,394) /usr/sbin/httpd
(apache,613344,211768,00:00:00/5-18:41:33,400) /usr/sbin/httpd
(apache,613336,211516,00:00:00/5-18:41:32,401) /usr/sbin/httpd
(root,0,0,00:00:00/1658-02:20:21,610) [kdmflush]
(root,0,0,00:00:00/1658-02:20:21,613) [kdmflush]
(root,0,0,00:00:00/1658-02:20:21,616) [kdmflush]
(root,0,0,00:00:00/1658-02:20:21,621) [kdmflush]
(root,0,0,00:00:00/1658-02:20:21,627) [kdmflush]
(root,10932,472,00:00:00/1658-02:20:21,628) /sbin/udevd -d
(root,0,0,00:00:00/1658-02:20:21,631) [kdmflush]
(root,10932,436,00:00:00/1658-02:20:21,632) /sbin/udevd -d
(root,0,0,00:18:09/1658-02:20:09,702) [flush-253:4]
(root,0,0,00:00:00/1658-02:20:00,706) [kjournald]
(root,0,0,00:00:00/1658-02:19:59,709) [xfs_mru_cache]
(root,0,0,00:12:37/1658-02:19:59,710) [xfslogd/0]
(root,0,0,00:00:00/1658-02:19:59,711) [xfslogd/1]
(root,0,0,00:17:33/1658-02:19:59,712) [xfsdatad/0]
(root,0,0,00:00:00/1658-02:19:59,713) [xfsdatad/1]
(root,0,0,00:00:00/1658-02:19:59,714) [xfsconvertd/0]
(root,0,0,00:00:00/1658-02:19:59,715) [xfsconvertd/1]
(root,0,0,00:00:13/1658-02:19:59,716) [xfsalloc/0]
(root,0,0,00:00:38/1658-02:19:59,717) [xfsalloc/1]
(root,0,0,00:00:13/1658-02:19:59,718) [xfseofblocks/0]
(root,0,0,00:00:48/1658-02:19:59,719) [xfseofblocks/1]
(root,0,0,00:00:00/1658-02:19:59,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1658-02:19:59,721) [xfs-cil/dm-3]
(root,0,0,00:01:55/1658-02:19:59,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1658-02:19:58,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1658-02:19:56,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1658-02:19:56,725) [xfs-cil/dm-2]
(root,0,0,00:01:57/1658-02:19:56,726) [xfssyncd/dm-2]
(root,0,0,08:52:01/1658-02:19:55,727) [xfsaild/dm-2]
(root,0,0,00:18:42/1658-02:19:28,728) [kjournald]
(root,0,0,00:08:07/1658-02:19:27,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1658-02:19:27,730) [xfs-cil/dm-5]
(root,0,0,00:07:48/1658-02:19:27,731) [xfssyncd/dm-5]
(root,0,0,11:57:05/1658-02:19:27,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1658-02:19:25,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1658-02:19:25,734) [xfs-cil/dm-7]
(root,0,0,00:01:56/1658-02:19:25,735) [xfssyncd/dm-7]
(root,0,0,08:54:50/1658-02:19:25,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1658-02:19:23,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1658-02:19:23,738) [xfs-cil/dm-6]
(root,0,0,00:01:59/1658-02:19:23,739) [xfssyncd/dm-6]
(root,0,0,08:55:06/1658-02:19:23,740) [xfsaild/dm-6]
(root,0,0,01:25:36/1658-02:19:04,816) [kauditd]
(root,93156,740,05:49:55/1658-02:18:50,1154) auditd
(root,249864,5540,03:19:35/1658-02:18:49,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:07:10/1658-02:18:48,1195) rpcbind
(rpcuser,23408,1184,00:00:00/1658-02:18:47,1215) rpc.statd
(dbus,21580,1000,00:00:08/1658-02:18:45,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1658-02:18:43,1285) hald
(root,20400,836,00:00:00/1658-02:18:43,1286) hald-runner
(root,452700,1136,00:39:47/1658-02:18:37,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:35:35/1658-02:18:32,1375) /usr/sbin/sshd
(root,21716,804,00:27:03/1658-02:18:31,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:25/1658-02:18:27,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:34/1658-02:18:19,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:47/1658-02:18:18,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:53/1658-02:18:08,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1658-02:18:06,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1658-02:18:06,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1658-02:18:06,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1442068,150124,10-09:46:58/1658-02:18:06,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:52/1658-02:17:46,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:14/1658-02:17:46,1759) inet_gethost 4
(root,112532,776,00:00:02/1658-02:17:45,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,611652,217400,01:40:01/1658-02:17:40,1776) /usr/sbin/httpd
(root,116864,704,00:14:19/1658-02:17:39,1786) crond
(root,21104,316,00:00:01/1658-02:17:39,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1658-02:17:39,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1658-02:17:39,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1658-02:17:39,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1658-02:17:39,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1658-02:17:39,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1658-02:17:39,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1658-02:17:39,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3360,00:00:00/04:39,3853) pickup -l -t fifo -u
(root,67568,3212,00:00:00/00:03,4546) sshd: [accepted] 
(root,98636,3788,00:00:00/00:03,4547) sshd: unknown [priv]
(sshd,67568,1744,00:00:00/00:03,4548) sshd: unknown [net]
(sshd,67568,1548,00:00:00/00:02,4549) sshd: [net]      
(root,67568,3248,00:00:00/00:02,4550) sshd: [accepted] 
(root,67568,3248,00:00:00/00:02,4551) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:01,4552) sshd: [net]      
(sshd,67568,1576,00:00:00/00:01,4553) sshd: [net]      
(root,110268,1492,00:00:00/00:00,4624) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,4642) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,4643) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,613344,211384,00:00:00/1-14:33:06,7906) /usr/sbin/httpd
(apache,611652,207056,00:00:00/6-16:23:55,11882) /usr/sbin/httpd
(apache,613336,211836,00:00:00/6-16:23:55,11892) /usr/sbin/httpd
(apache,613336,211852,00:00:00/6-16:23:55,11901) /usr/sbin/httpd
(apache,613344,211812,00:00:00/6-16:23:55,11912) /usr/sbin/httpd
(apache,613336,211848,00:00:00/6-16:23:55,11922) /usr/sbin/httpd
(apache,613336,211800,00:00:01/6-16:23:55,11933) /usr/sbin/httpd
(apache,613336,211856,00:00:01/6-16:23:55,11944) /usr/sbin/httpd
(apache,613344,211808,00:00:00/6-16:23:55,11955) /usr/sbin/httpd
(apache,613344,211824,00:00:00/6-16:23:55,11967) /usr/sbin/httpd
(root,108468,1060,00:00:00/855-10:30:24,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/855-10:30:24,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/855-10:30:24,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14988,2-23:43:24/855-10:30:24,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:01/1-12:10:51,25806) [flush-253:5]

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-22 00:58

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939d01edd45

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:40:09/1656-01:54:55,1) /sbin/init
(root,0,0,00:00:05/1656-01:54:55,2) [kthreadd]
(root,0,0,00:15:18/1656-01:54:55,3) [migration/0]
(root,0,0,00:13:37/1656-01:54:55,4) [ksoftirqd/0]
(root,0,0,00:00:00/1656-01:54:55,5) [stopper/0]
(root,0,0,00:04:20/1656-01:54:55,6) [watchdog/0]
(root,0,0,00:23:14/1656-01:54:55,7) [migration/1]
(root,0,0,00:00:00/1656-01:54:55,8) [stopper/1]
(root,0,0,00:07:50/1656-01:54:55,9) [ksoftirqd/1]
(root,0,0,00:04:02/1656-01:54:55,10) [watchdog/1]
(root,0,0,02:57:33/1656-01:54:55,11) [events/0]
(root,0,0,03:09:37/1656-01:54:55,12) [events/1]
(root,0,0,00:00:00/1656-01:54:55,13) [cgroup]
(root,0,0,00:00:00/1656-01:54:55,14) [khelper]
(root,0,0,00:00:00/1656-01:54:55,15) [netns]
(root,0,0,00:00:00/1656-01:54:55,16) [async/mgr]
(root,0,0,00:00:00/1656-01:54:55,17) [pm]
(root,0,0,00:00:00/1656-01:54:55,18) [xenwatch]
(root,0,0,00:00:00/1656-01:54:55,19) [xenbus]
(root,0,0,00:09:28/1656-01:54:55,20) [sync_supers]
(root,0,0,00:11:14/1656-01:54:55,21) [bdi-default]
(root,0,0,00:00:00/1656-01:54:55,22) [kintegrityd/0]
(root,0,0,00:00:00/1656-01:54:55,23) [kintegrityd/1]
(root,0,0,00:09:57/1656-01:54:55,24) [kblockd/0]
(root,0,0,00:01:54/1656-01:54:55,25) [kblockd/1]
(root,0,0,00:00:00/1656-01:54:55,26) [ata_aux]
(root,0,0,00:00:00/1656-01:54:55,27) [ata_sff/0]
(root,0,0,00:00:00/1656-01:54:55,28) [ata_sff/1]
(root,0,0,00:00:00/1656-01:54:55,29) [ksuspend_usbd]
(root,0,0,00:00:00/1656-01:54:55,30) [khubd]
(root,0,0,00:00:00/1656-01:54:55,31) [kseriod]
(root,0,0,00:00:00/1656-01:54:55,32) [md/0]
(root,0,0,00:00:00/1656-01:54:55,33) [md/1]
(root,0,0,00:00:00/1656-01:54:55,34) [md_misc/0]
(root,0,0,00:00:00/1656-01:54:55,35) [md_misc/1]
(root,0,0,00:00:00/1656-01:54:55,36) [linkwatch]
(root,0,0,00:00:54/1656-01:54:55,37) [khungtaskd]
(root,0,0,00:00:09/1656-01:54:55,38) [kswapd0]
(root,0,0,00:00:00/1656-01:54:55,39) [ksmd]
(root,0,0,00:00:00/1656-01:54:55,40) [aio/0]
(root,0,0,00:00:00/1656-01:54:55,41) [aio/1]
(root,0,0,00:00:00/1656-01:54:55,42) [crypto/0]
(root,0,0,00:00:00/1656-01:54:55,43) [crypto/1]
(root,0,0,00:00:00/1656-01:54:55,51) [kthrotld/0]
(root,0,0,00:00:00/1656-01:54:55,52) [kthrotld/1]
(root,0,0,00:00:00/1656-01:54:55,54) [khvcd]
(root,0,0,00:00:00/1656-01:54:55,55) [kpsmoused]
(root,0,0,00:00:00/1656-01:54:55,56) [usbhid_resumer]
(root,0,0,00:00:00/1656-01:54:55,57) [deferwq]
(root,0,0,00:00:00/1656-01:54:55,89) [kdmremove]
(root,0,0,00:00:00/1656-01:54:55,90) [kstriped]
(root,0,0,00:00:00/1656-01:54:50,233) [kdmflush]
(root,0,0,00:00:00/1656-01:54:50,235) [kdmflush]
(root,0,0,00:00:30/1656-01:54:37,252) [kjournald]
(root,10936,368,00:00:00/1656-01:54:17,341) /sbin/udevd -d
(apache,613336,211720,00:00:00/3-18:15:15,394) /usr/sbin/httpd
(apache,613344,211744,00:00:00/3-18:15:14,400) /usr/sbin/httpd
(apache,613336,211444,00:00:00/3-18:15:13,401) /usr/sbin/httpd
(root,0,0,00:00:00/1656-01:54:02,610) [kdmflush]
(root,0,0,00:00:00/1656-01:54:02,613) [kdmflush]
(root,0,0,00:00:00/1656-01:54:02,616) [kdmflush]
(root,0,0,00:00:00/1656-01:54:02,621) [kdmflush]
(root,0,0,00:00:00/1656-01:54:02,627) [kdmflush]
(root,10932,472,00:00:00/1656-01:54:02,628) /sbin/udevd -d
(root,0,0,00:00:00/1656-01:54:02,631) [kdmflush]
(root,10932,436,00:00:00/1656-01:54:02,632) /sbin/udevd -d
(root,0,0,00:18:08/1656-01:53:50,702) [flush-253:4]
(root,0,0,00:00:00/1656-01:53:41,706) [kjournald]
(root,0,0,00:00:00/1656-01:53:40,709) [xfs_mru_cache]
(root,0,0,00:12:37/1656-01:53:40,710) [xfslogd/0]
(root,0,0,00:00:00/1656-01:53:40,711) [xfslogd/1]
(root,0,0,00:17:32/1656-01:53:40,712) [xfsdatad/0]
(root,0,0,00:00:00/1656-01:53:40,713) [xfsdatad/1]
(root,0,0,00:00:00/1656-01:53:40,714) [xfsconvertd/0]
(root,0,0,00:00:00/1656-01:53:40,715) [xfsconvertd/1]
(root,0,0,00:00:13/1656-01:53:40,716) [xfsalloc/0]
(root,0,0,00:00:38/1656-01:53:40,717) [xfsalloc/1]
(root,0,0,00:00:13/1656-01:53:40,718) [xfseofblocks/0]
(root,0,0,00:00:48/1656-01:53:40,719) [xfseofblocks/1]
(root,0,0,00:00:00/1656-01:53:40,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1656-01:53:40,721) [xfs-cil/dm-3]
(root,0,0,00:01:55/1656-01:53:40,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1656-01:53:39,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1656-01:53:37,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1656-01:53:37,725) [xfs-cil/dm-2]
(root,0,0,00:01:57/1656-01:53:37,726) [xfssyncd/dm-2]
(root,0,0,08:51:20/1656-01:53:36,727) [xfsaild/dm-2]
(root,0,0,00:18:41/1656-01:53:09,728) [kjournald]
(root,0,0,00:08:06/1656-01:53:08,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1656-01:53:08,730) [xfs-cil/dm-5]
(root,0,0,00:07:48/1656-01:53:08,731) [xfssyncd/dm-5]
(root,0,0,11:56:09/1656-01:53:08,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1656-01:53:06,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1656-01:53:06,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1656-01:53:06,735) [xfssyncd/dm-7]
(root,0,0,08:54:10/1656-01:53:06,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1656-01:53:04,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1656-01:53:04,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1656-01:53:04,739) [xfssyncd/dm-6]
(root,0,0,08:54:25/1656-01:53:04,740) [xfsaild/dm-6]
(root,0,0,01:25:16/1656-01:52:45,816) [kauditd]
(root,93156,740,05:49:09/1656-01:52:31,1154) auditd
(root,249864,5540,03:18:49/1656-01:52:30,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:07:10/1656-01:52:29,1195) rpcbind
(rpcuser,23408,1184,00:00:00/1656-01:52:28,1215) rpc.statd
(dbus,21580,1000,00:00:08/1656-01:52:26,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1656-01:52:24,1285) hald
(root,20400,836,00:00:00/1656-01:52:24,1286) hald-runner
(root,452700,1136,00:39:44/1656-01:52:18,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:33:53/1656-01:52:13,1375) /usr/sbin/sshd
(root,21716,804,00:27:01/1656-01:52:12,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:23/1656-01:52:08,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:33/1656-01:52:00,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:47/1656-01:51:59,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:51/1656-01:51:49,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1656-01:51:47,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1656-01:51:47,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1656-01:51:47,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,152296,10-09:28:37/1656-01:51:47,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:52/1656-01:51:27,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:13/1656-01:51:27,1759) inet_gethost 4
(root,112532,776,00:00:02/1656-01:51:26,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,611652,217400,01:39:53/1656-01:51:21,1776) /usr/sbin/httpd
(root,116864,704,00:14:18/1656-01:51:20,1786) crond
(root,21104,316,00:00:01/1656-01:51:20,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1656-01:51:20,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1656-01:51:20,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1656-01:51:20,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1656-01:51:20,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1656-01:51:20,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1656-01:51:20,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1656-01:51:20,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:33/37-09:02:09,11877) [flush-253:5]
(apache,611652,207056,00:00:00/4-15:57:36,11882) /usr/sbin/httpd
(apache,613336,211820,00:00:00/4-15:57:36,11892) /usr/sbin/httpd
(apache,613336,211824,00:00:00/4-15:57:36,11901) /usr/sbin/httpd
(apache,613344,211796,00:00:00/4-15:57:36,11912) /usr/sbin/httpd
(apache,613336,211828,00:00:00/4-15:57:36,11922) /usr/sbin/httpd
(apache,613336,211788,00:00:00/4-15:57:36,11933) /usr/sbin/httpd
(apache,613336,211840,00:00:00/4-15:57:36,11944) /usr/sbin/httpd
(apache,613344,211784,00:00:00/4-15:57:36,11955) /usr/sbin/httpd
(apache,613344,211812,00:00:00/4-15:57:36,11967) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/00:48,18749) pickup -l -t fifo -u
(root,67568,3240,00:00:00/00:28,18765) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:26,18769) sshd: [net]      
(root,66224,3104,00:00:00/00:01,18957) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,18960) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,18978) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,18979) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/853-10:04:05,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/853-10:04:05,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/853-10:04:05,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14928,2-23:31:46/853-10:04:05,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-20 00:31

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79398d4522a1

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:40:01/1654-03:03:28,1) /sbin/init
(root,0,0,00:00:05/1654-03:03:28,2) [kthreadd]
(root,0,0,00:15:17/1654-03:03:28,3) [migration/0]
(root,0,0,00:13:36/1654-03:03:28,4) [ksoftirqd/0]
(root,0,0,00:00:00/1654-03:03:28,5) [stopper/0]
(root,0,0,00:04:19/1654-03:03:28,6) [watchdog/0]
(root,0,0,00:23:12/1654-03:03:28,7) [migration/1]
(root,0,0,00:00:00/1654-03:03:28,8) [stopper/1]
(root,0,0,00:07:50/1654-03:03:28,9) [ksoftirqd/1]
(root,0,0,00:04:02/1654-03:03:28,10) [watchdog/1]
(root,0,0,02:57:20/1654-03:03:28,11) [events/0]
(root,0,0,03:09:23/1654-03:03:28,12) [events/1]
(root,0,0,00:00:00/1654-03:03:28,13) [cgroup]
(root,0,0,00:00:00/1654-03:03:28,14) [khelper]
(root,0,0,00:00:00/1654-03:03:28,15) [netns]
(root,0,0,00:00:00/1654-03:03:28,16) [async/mgr]
(root,0,0,00:00:00/1654-03:03:28,17) [pm]
(root,0,0,00:00:00/1654-03:03:28,18) [xenwatch]
(root,0,0,00:00:00/1654-03:03:28,19) [xenbus]
(root,0,0,00:09:27/1654-03:03:28,20) [sync_supers]
(root,0,0,00:11:14/1654-03:03:28,21) [bdi-default]
(root,0,0,00:00:00/1654-03:03:28,22) [kintegrityd/0]
(root,0,0,00:00:00/1654-03:03:28,23) [kintegrityd/1]
(root,0,0,00:09:57/1654-03:03:28,24) [kblockd/0]
(root,0,0,00:01:54/1654-03:03:28,25) [kblockd/1]
(root,0,0,00:00:00/1654-03:03:28,26) [ata_aux]
(root,0,0,00:00:00/1654-03:03:28,27) [ata_sff/0]
(root,0,0,00:00:00/1654-03:03:28,28) [ata_sff/1]
(root,0,0,00:00:00/1654-03:03:28,29) [ksuspend_usbd]
(root,0,0,00:00:00/1654-03:03:28,30) [khubd]
(root,0,0,00:00:00/1654-03:03:28,31) [kseriod]
(root,0,0,00:00:00/1654-03:03:28,32) [md/0]
(root,0,0,00:00:00/1654-03:03:28,33) [md/1]
(root,0,0,00:00:00/1654-03:03:28,34) [md_misc/0]
(root,0,0,00:00:00/1654-03:03:28,35) [md_misc/1]
(root,0,0,00:00:00/1654-03:03:28,36) [linkwatch]
(root,0,0,00:00:54/1654-03:03:28,37) [khungtaskd]
(root,0,0,00:00:09/1654-03:03:28,38) [kswapd0]
(root,0,0,00:00:00/1654-03:03:28,39) [ksmd]
(root,0,0,00:00:00/1654-03:03:28,40) [aio/0]
(root,0,0,00:00:00/1654-03:03:28,41) [aio/1]
(root,0,0,00:00:00/1654-03:03:28,42) [crypto/0]
(root,0,0,00:00:00/1654-03:03:28,43) [crypto/1]
(root,0,0,00:00:00/1654-03:03:28,51) [kthrotld/0]
(root,0,0,00:00:00/1654-03:03:28,52) [kthrotld/1]
(root,0,0,00:00:00/1654-03:03:28,54) [khvcd]
(root,0,0,00:00:00/1654-03:03:28,55) [kpsmoused]
(root,0,0,00:00:00/1654-03:03:28,56) [usbhid_resumer]
(root,0,0,00:00:00/1654-03:03:28,57) [deferwq]
(root,0,0,00:00:00/1654-03:03:28,89) [kdmremove]
(root,0,0,00:00:00/1654-03:03:28,90) [kstriped]
(root,0,0,00:00:00/1654-03:03:23,233) [kdmflush]
(root,0,0,00:00:00/1654-03:03:23,235) [kdmflush]
(root,0,0,00:00:30/1654-03:03:10,252) [kjournald]
(root,10936,368,00:00:00/1654-03:02:50,341) /sbin/udevd -d
(apache,613336,211408,00:00:00/1-19:23:48,394) /usr/sbin/httpd
(apache,613344,211388,00:00:00/1-19:23:47,400) /usr/sbin/httpd
(apache,613336,211388,00:00:00/1-19:23:46,401) /usr/sbin/httpd
(root,0,0,00:00:00/1654-03:02:35,610) [kdmflush]
(root,0,0,00:00:00/1654-03:02:35,613) [kdmflush]
(root,0,0,00:00:00/1654-03:02:35,616) [kdmflush]
(root,0,0,00:00:00/1654-03:02:35,621) [kdmflush]
(root,0,0,00:00:00/1654-03:02:35,627) [kdmflush]
(root,10932,472,00:00:00/1654-03:02:35,628) /sbin/udevd -d
(root,0,0,00:00:00/1654-03:02:35,631) [kdmflush]
(root,10932,436,00:00:00/1654-03:02:35,632) /sbin/udevd -d
(root,0,0,00:18:06/1654-03:02:23,702) [flush-253:4]
(root,0,0,00:00:00/1654-03:02:14,706) [kjournald]
(root,0,0,00:00:00/1654-03:02:13,709) [xfs_mru_cache]
(root,0,0,00:12:36/1654-03:02:13,710) [xfslogd/0]
(root,0,0,00:00:00/1654-03:02:13,711) [xfslogd/1]
(root,0,0,00:17:32/1654-03:02:13,712) [xfsdatad/0]
(root,0,0,00:00:00/1654-03:02:13,713) [xfsdatad/1]
(root,0,0,00:00:00/1654-03:02:13,714) [xfsconvertd/0]
(root,0,0,00:00:00/1654-03:02:13,715) [xfsconvertd/1]
(root,0,0,00:00:13/1654-03:02:13,716) [xfsalloc/0]
(root,0,0,00:00:38/1654-03:02:13,717) [xfsalloc/1]
(root,0,0,00:00:13/1654-03:02:13,718) [xfseofblocks/0]
(root,0,0,00:00:48/1654-03:02:13,719) [xfseofblocks/1]
(root,0,0,00:00:00/1654-03:02:13,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1654-03:02:13,721) [xfs-cil/dm-3]
(root,0,0,00:01:55/1654-03:02:13,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1654-03:02:12,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1654-03:02:10,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1654-03:02:10,725) [xfs-cil/dm-2]
(root,0,0,00:01:57/1654-03:02:10,726) [xfssyncd/dm-2]
(root,0,0,08:50:39/1654-03:02:09,727) [xfsaild/dm-2]
(root,0,0,00:18:40/1654-03:01:42,728) [kjournald]
(root,0,0,00:08:06/1654-03:01:41,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1654-03:01:41,730) [xfs-cil/dm-5]
(root,0,0,00:07:47/1654-03:01:41,731) [xfssyncd/dm-5]
(root,0,0,11:55:17/1654-03:01:41,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1654-03:01:39,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1654-03:01:39,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1654-03:01:39,735) [xfssyncd/dm-7]
(root,0,0,08:53:27/1654-03:01:39,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1654-03:01:37,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1654-03:01:37,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1654-03:01:37,739) [xfssyncd/dm-6]
(root,0,0,08:53:45/1654-03:01:37,740) [xfsaild/dm-6]
(root,0,0,01:24:59/1654-03:01:18,816) [kauditd]
(root,93156,740,05:48:30/1654-03:01:04,1154) auditd
(root,249864,5540,03:18:06/1654-03:01:03,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:07:10/1654-03:01:02,1195) rpcbind
(rpcuser,23408,1184,00:00:00/1654-03:01:01,1215) rpc.statd
(dbus,21580,1000,00:00:08/1654-03:00:59,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1654-03:00:57,1285) hald
(root,20400,836,00:00:00/1654-03:00:57,1286) hald-runner
(root,452700,1136,00:39:41/1654-03:00:51,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:32:28/1654-03:00:46,1375) /usr/sbin/sshd
(root,21716,804,00:26:59/1654-03:00:45,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:21/1654-03:00:41,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:32/1654-03:00:33,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:47/1654-03:00:32,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:49/1654-03:00:22,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1654-03:00:20,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1654-03:00:20,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1654-03:00:20,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,154844,10-09:11:01/1654-03:00:20,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:52/1654-03:00:00,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:13/1654-03:00:00,1759) inet_gethost 4
(root,112532,776,00:00:02/1654-02:59:59,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,611652,217400,01:39:45/1654-02:59:54,1776) /usr/sbin/httpd
(root,116864,704,00:14:17/1654-02:59:53,1786) crond
(root,21104,316,00:00:01/1654-02:59:53,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1654-02:59:53,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1654-02:59:53,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1654-02:59:53,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1654-02:59:53,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1654-02:59:53,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1654-02:59:53,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1654-02:59:53,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,101288,4268,00:00:00/00:05,9249) sshd: root [priv]
(sshd,67568,1652,00:00:00/00:04,9250) sshd: root [net] 
(root,98636,3784,00:00:00/00:04,9251) sshd: unknown [priv]
(sshd,67568,1740,00:00:00/00:04,9252) sshd: unknown [net]
(root,66224,3104,00:00:00/00:01,9353) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,9354) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,9372) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,9373) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:31/35-10:10:42,11877) [flush-253:5]
(apache,611652,207056,00:00:00/2-17:06:09,11882) /usr/sbin/httpd
(apache,613336,211484,00:00:00/2-17:06:09,11892) /usr/sbin/httpd
(apache,613336,211524,00:00:00/2-17:06:09,11901) /usr/sbin/httpd
(apache,613344,211448,00:00:00/2-17:06:09,11912) /usr/sbin/httpd
(apache,613336,211508,00:00:00/2-17:06:09,11922) /usr/sbin/httpd
(apache,613336,211472,00:00:00/2-17:06:09,11933) /usr/sbin/httpd
(apache,613336,211500,00:00:00/2-17:06:09,11944) /usr/sbin/httpd
(apache,613344,211468,00:00:00/2-17:06:09,11955) /usr/sbin/httpd
(apache,613344,211488,00:00:00/2-17:06:09,11967) /usr/sbin/httpd
(root,108468,1060,00:00:00/851-11:12:38,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/851-11:12:38,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/851-11:12:38,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,16304,2-23:20:35/851-11:12:38,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3368,00:00:00/01:31:51,27920) pickup -l -t fifo -u

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-18 01:40

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79396dc3f7de

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:39:54/1652-00:43:01,1) /sbin/init
(root,0,0,00:00:05/1652-00:43:01,2) [kthreadd]
(root,0,0,00:15:16/1652-00:43:01,3) [migration/0]
(root,0,0,00:13:34/1652-00:43:01,4) [ksoftirqd/0]
(root,0,0,00:00:00/1652-00:43:01,5) [stopper/0]
(root,0,0,00:04:19/1652-00:43:01,6) [watchdog/0]
(root,0,0,00:23:10/1652-00:43:01,7) [migration/1]
(root,0,0,00:00:00/1652-00:43:01,8) [stopper/1]
(root,0,0,00:07:49/1652-00:43:01,9) [ksoftirqd/1]
(root,0,0,00:04:01/1652-00:43:01,10) [watchdog/1]
(root,0,0,02:57:06/1652-00:43:01,11) [events/0]
(root,0,0,03:09:07/1652-00:43:01,12) [events/1]
(root,0,0,00:00:00/1652-00:43:01,13) [cgroup]
(root,0,0,00:00:00/1652-00:43:01,14) [khelper]
(root,0,0,00:00:00/1652-00:43:01,15) [netns]
(root,0,0,00:00:00/1652-00:43:01,16) [async/mgr]
(root,0,0,00:00:00/1652-00:43:01,17) [pm]
(root,0,0,00:00:00/1652-00:43:01,18) [xenwatch]
(root,0,0,00:00:00/1652-00:43:01,19) [xenbus]
(root,0,0,00:09:26/1652-00:43:01,20) [sync_supers]
(root,0,0,00:11:13/1652-00:43:01,21) [bdi-default]
(root,0,0,00:00:00/1652-00:43:01,22) [kintegrityd/0]
(root,0,0,00:00:00/1652-00:43:01,23) [kintegrityd/1]
(root,0,0,00:09:56/1652-00:43:01,24) [kblockd/0]
(root,0,0,00:01:53/1652-00:43:01,25) [kblockd/1]
(root,0,0,00:00:00/1652-00:43:01,26) [ata_aux]
(root,0,0,00:00:00/1652-00:43:01,27) [ata_sff/0]
(root,0,0,00:00:00/1652-00:43:01,28) [ata_sff/1]
(root,0,0,00:00:00/1652-00:43:01,29) [ksuspend_usbd]
(root,0,0,00:00:00/1652-00:43:01,30) [khubd]
(root,0,0,00:00:00/1652-00:43:01,31) [kseriod]
(root,0,0,00:00:00/1652-00:43:01,32) [md/0]
(root,0,0,00:00:00/1652-00:43:01,33) [md/1]
(root,0,0,00:00:00/1652-00:43:01,34) [md_misc/0]
(root,0,0,00:00:00/1652-00:43:01,35) [md_misc/1]
(root,0,0,00:00:00/1652-00:43:01,36) [linkwatch]
(root,0,0,00:00:54/1652-00:43:01,37) [khungtaskd]
(root,0,0,00:00:09/1652-00:43:01,38) [kswapd0]
(root,0,0,00:00:00/1652-00:43:01,39) [ksmd]
(root,0,0,00:00:00/1652-00:43:01,40) [aio/0]
(root,0,0,00:00:00/1652-00:43:01,41) [aio/1]
(root,0,0,00:00:00/1652-00:43:01,42) [crypto/0]
(root,0,0,00:00:00/1652-00:43:01,43) [crypto/1]
(root,0,0,00:00:00/1652-00:43:01,51) [kthrotld/0]
(root,0,0,00:00:00/1652-00:43:01,52) [kthrotld/1]
(root,0,0,00:00:00/1652-00:43:01,54) [khvcd]
(root,0,0,00:00:00/1652-00:43:01,55) [kpsmoused]
(root,0,0,00:00:00/1652-00:43:01,56) [usbhid_resumer]
(root,0,0,00:00:00/1652-00:43:01,57) [deferwq]
(root,0,0,00:00:00/1652-00:43:01,89) [kdmremove]
(root,0,0,00:00:00/1652-00:43:01,90) [kstriped]
(root,0,0,00:00:00/1652-00:42:56,233) [kdmflush]
(root,0,0,00:00:00/1652-00:42:56,235) [kdmflush]
(root,0,0,00:00:30/1652-00:42:43,252) [kjournald]
(root,10936,368,00:00:00/1652-00:42:23,341) /sbin/udevd -d
(root,0,0,00:00:00/1652-00:42:08,610) [kdmflush]
(root,0,0,00:00:00/1652-00:42:08,613) [kdmflush]
(root,0,0,00:00:00/1652-00:42:08,616) [kdmflush]
(root,0,0,00:00:00/1652-00:42:08,621) [kdmflush]
(root,0,0,00:00:00/1652-00:42:08,627) [kdmflush]
(root,10932,472,00:00:00/1652-00:42:08,628) /sbin/udevd -d
(root,0,0,00:00:00/1652-00:42:08,631) [kdmflush]
(root,10932,436,00:00:00/1652-00:42:08,632) /sbin/udevd -d
(root,0,0,00:18:05/1652-00:41:56,702) [flush-253:4]
(root,0,0,00:00:00/1652-00:41:47,706) [kjournald]
(root,0,0,00:00:00/1652-00:41:46,709) [xfs_mru_cache]
(root,0,0,00:12:36/1652-00:41:46,710) [xfslogd/0]
(root,0,0,00:00:00/1652-00:41:46,711) [xfslogd/1]
(root,0,0,00:17:31/1652-00:41:46,712) [xfsdatad/0]
(root,0,0,00:00:00/1652-00:41:46,713) [xfsdatad/1]
(root,0,0,00:00:00/1652-00:41:46,714) [xfsconvertd/0]
(root,0,0,00:00:00/1652-00:41:46,715) [xfsconvertd/1]
(root,0,0,00:00:13/1652-00:41:46,716) [xfsalloc/0]
(root,0,0,00:00:38/1652-00:41:46,717) [xfsalloc/1]
(root,0,0,00:00:13/1652-00:41:46,718) [xfseofblocks/0]
(root,0,0,00:00:48/1652-00:41:46,719) [xfseofblocks/1]
(root,0,0,00:00:00/1652-00:41:46,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1652-00:41:46,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1652-00:41:46,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1652-00:41:45,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1652-00:41:43,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1652-00:41:43,725) [xfs-cil/dm-2]
(root,0,0,00:01:57/1652-00:41:43,726) [xfssyncd/dm-2]
(root,0,0,08:49:55/1652-00:41:42,727) [xfsaild/dm-2]
(root,0,0,00:18:38/1652-00:41:15,728) [kjournald]
(root,0,0,00:08:06/1652-00:41:14,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1652-00:41:14,730) [xfs-cil/dm-5]
(root,0,0,00:07:47/1652-00:41:14,731) [xfssyncd/dm-5]
(root,0,0,11:54:21/1652-00:41:14,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1652-00:41:12,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1652-00:41:12,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1652-00:41:12,735) [xfssyncd/dm-7]
(root,0,0,08:52:42/1652-00:41:12,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1652-00:41:10,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1652-00:41:10,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1652-00:41:10,739) [xfssyncd/dm-6]
(root,0,0,08:53:00/1652-00:41:10,740) [xfsaild/dm-6]
(root,0,0,01:24:44/1652-00:40:51,816) [kauditd]
(root,93156,740,05:47:55/1652-00:40:37,1154) auditd
(root,249864,5540,03:17:28/1652-00:40:36,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:09/1652-00:40:35,1195) rpcbind
(rpcuser,23532,1184,00:00:00/1652-00:40:34,1215) rpc.statd
(dbus,21580,1000,00:00:08/1652-00:40:32,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1652-00:40:30,1285) hald
(root,20400,836,00:00:00/1652-00:40:30,1286) hald-runner
(root,452700,1136,00:39:38/1652-00:40:24,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:31:12/1652-00:40:19,1375) /usr/sbin/sshd
(root,21716,804,00:26:57/1652-00:40:18,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:18/1652-00:40:14,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:31/1652-00:40:06,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:47/1652-00:40:05,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:47/1652-00:39:55,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1652-00:39:53,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1652-00:39:53,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1652-00:39:53,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443228,159152,10-08:51:08/1652-00:39:53,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:52/1652-00:39:33,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:13/1652-00:39:33,1759) inet_gethost 4
(root,112532,776,00:00:02/1652-00:39:32,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,611652,217400,01:39:37/1652-00:39:27,1776) /usr/sbin/httpd
(root,116864,704,00:14:16/1652-00:39:26,1786) crond
(root,21104,316,00:00:01/1652-00:39:26,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1652-00:39:26,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1652-00:39:26,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1652-00:39:26,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1652-00:39:26,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1652-00:39:26,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1652-00:39:26,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1652-00:39:26,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:30/33-07:50:15,11877) [flush-253:5]
(apache,611652,207056,00:00:00/14:45:42,11882) /usr/sbin/httpd
(apache,613336,211364,00:00:00/14:45:42,11892) /usr/sbin/httpd
(apache,613336,211440,00:00:00/14:45:42,11901) /usr/sbin/httpd
(apache,613344,211352,00:00:00/14:45:42,11912) /usr/sbin/httpd
(apache,613336,211440,00:00:00/14:45:42,11922) /usr/sbin/httpd
(apache,613336,211372,00:00:00/14:45:42,11933) /usr/sbin/httpd
(apache,613336,211412,00:00:00/14:45:42,11944) /usr/sbin/httpd
(apache,613344,211372,00:00:00/14:45:42,11955) /usr/sbin/httpd
(apache,613344,211400,00:00:00/14:45:42,11967) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/01:13:59,14975) pickup -l -t fifo -u
(root,108468,1060,00:00:00/849-08:52:11,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/849-08:52:11,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/849-08:52:11,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14960,2-23:08:41/849-08:52:11,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/03:00,26556) [flush-253:1]
(root,66224,3104,00:00:00/01:46,26740) sshd: [accepted] 
(root,98636,3808,00:00:00/00:05,27038) sshd: postfix [priv]
(sshd,67568,1652,00:00:00/00:05,27039) sshd: postfix [net]
(root,67568,3244,00:00:00/00:02,27042) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:01,27043) sshd: [net]      
(root,110268,1488,00:00:00/00:00,27120) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,27138) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,27139) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-15 23:19

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793998b57892

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:39:46/1650-00:23:04,1) /sbin/init
(root,0,0,00:00:05/1650-00:23:04,2) [kthreadd]
(root,0,0,00:15:15/1650-00:23:04,3) [migration/0]
(root,0,0,00:13:33/1650-00:23:04,4) [ksoftirqd/0]
(root,0,0,00:00:00/1650-00:23:04,5) [stopper/0]
(root,0,0,00:04:19/1650-00:23:04,6) [watchdog/0]
(root,0,0,00:23:07/1650-00:23:04,7) [migration/1]
(root,0,0,00:00:00/1650-00:23:04,8) [stopper/1]
(root,0,0,00:07:48/1650-00:23:04,9) [ksoftirqd/1]
(root,0,0,00:04:01/1650-00:23:04,10) [watchdog/1]
(root,0,0,02:56:53/1650-00:23:04,11) [events/0]
(root,0,0,03:08:52/1650-00:23:04,12) [events/1]
(root,0,0,00:00:00/1650-00:23:04,13) [cgroup]
(root,0,0,00:00:00/1650-00:23:04,14) [khelper]
(root,0,0,00:00:00/1650-00:23:04,15) [netns]
(root,0,0,00:00:00/1650-00:23:04,16) [async/mgr]
(root,0,0,00:00:00/1650-00:23:04,17) [pm]
(root,0,0,00:00:00/1650-00:23:04,18) [xenwatch]
(root,0,0,00:00:00/1650-00:23:04,19) [xenbus]
(root,0,0,00:09:26/1650-00:23:04,20) [sync_supers]
(root,0,0,00:11:12/1650-00:23:04,21) [bdi-default]
(root,0,0,00:00:00/1650-00:23:04,22) [kintegrityd/0]
(root,0,0,00:00:00/1650-00:23:04,23) [kintegrityd/1]
(root,0,0,00:09:56/1650-00:23:04,24) [kblockd/0]
(root,0,0,00:01:53/1650-00:23:04,25) [kblockd/1]
(root,0,0,00:00:00/1650-00:23:04,26) [ata_aux]
(root,0,0,00:00:00/1650-00:23:04,27) [ata_sff/0]
(root,0,0,00:00:00/1650-00:23:04,28) [ata_sff/1]
(root,0,0,00:00:00/1650-00:23:04,29) [ksuspend_usbd]
(root,0,0,00:00:00/1650-00:23:04,30) [khubd]
(root,0,0,00:00:00/1650-00:23:04,31) [kseriod]
(root,0,0,00:00:00/1650-00:23:04,32) [md/0]
(root,0,0,00:00:00/1650-00:23:04,33) [md/1]
(root,0,0,00:00:00/1650-00:23:04,34) [md_misc/0]
(root,0,0,00:00:00/1650-00:23:04,35) [md_misc/1]
(root,0,0,00:00:00/1650-00:23:04,36) [linkwatch]
(root,0,0,00:00:54/1650-00:23:04,37) [khungtaskd]
(root,0,0,00:00:09/1650-00:23:04,38) [kswapd0]
(root,0,0,00:00:00/1650-00:23:04,39) [ksmd]
(root,0,0,00:00:00/1650-00:23:04,40) [aio/0]
(root,0,0,00:00:00/1650-00:23:04,41) [aio/1]
(root,0,0,00:00:00/1650-00:23:04,42) [crypto/0]
(root,0,0,00:00:00/1650-00:23:04,43) [crypto/1]
(root,0,0,00:00:00/1650-00:23:04,51) [kthrotld/0]
(root,0,0,00:00:00/1650-00:23:04,52) [kthrotld/1]
(root,0,0,00:00:00/1650-00:23:04,54) [khvcd]
(root,0,0,00:00:00/1650-00:23:04,55) [kpsmoused]
(root,0,0,00:00:00/1650-00:23:04,56) [usbhid_resumer]
(root,0,0,00:00:00/1650-00:23:04,57) [deferwq]
(root,0,0,00:00:00/1650-00:23:04,89) [kdmremove]
(root,0,0,00:00:00/1650-00:23:04,90) [kstriped]
(root,0,0,00:00:00/1650-00:22:59,233) [kdmflush]
(root,0,0,00:00:00/1650-00:22:59,235) [kdmflush]
(root,0,0,00:00:30/1650-00:22:46,252) [kjournald]
(root,10936,368,00:00:00/1650-00:22:26,341) /sbin/udevd -d
(root,0,0,00:00:00/1650-00:22:11,610) [kdmflush]
(root,0,0,00:00:00/1650-00:22:11,613) [kdmflush]
(root,0,0,00:00:00/1650-00:22:11,616) [kdmflush]
(root,0,0,00:00:00/1650-00:22:11,621) [kdmflush]
(root,0,0,00:00:00/1650-00:22:11,627) [kdmflush]
(root,10932,472,00:00:00/1650-00:22:11,628) /sbin/udevd -d
(root,0,0,00:00:00/1650-00:22:11,631) [kdmflush]
(root,10932,436,00:00:00/1650-00:22:11,632) /sbin/udevd -d
(root,0,0,00:18:04/1650-00:21:59,702) [flush-253:4]
(root,0,0,00:00:00/1650-00:21:50,706) [kjournald]
(root,0,0,00:00:00/1650-00:21:49,709) [xfs_mru_cache]
(root,0,0,00:12:36/1650-00:21:49,710) [xfslogd/0]
(root,0,0,00:00:00/1650-00:21:49,711) [xfslogd/1]
(root,0,0,00:17:31/1650-00:21:49,712) [xfsdatad/0]
(root,0,0,00:00:00/1650-00:21:49,713) [xfsdatad/1]
(root,0,0,00:00:00/1650-00:21:49,714) [xfsconvertd/0]
(root,0,0,00:00:00/1650-00:21:49,715) [xfsconvertd/1]
(root,0,0,00:00:13/1650-00:21:49,716) [xfsalloc/0]
(root,0,0,00:00:38/1650-00:21:49,717) [xfsalloc/1]
(root,0,0,00:00:13/1650-00:21:49,718) [xfseofblocks/0]
(root,0,0,00:00:48/1650-00:21:49,719) [xfseofblocks/1]
(root,0,0,00:00:00/1650-00:21:49,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1650-00:21:49,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1650-00:21:49,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1650-00:21:48,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1650-00:21:46,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1650-00:21:46,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1650-00:21:46,726) [xfssyncd/dm-2]
(root,0,0,08:49:12/1650-00:21:45,727) [xfsaild/dm-2]
(root,0,0,00:18:36/1650-00:21:18,728) [kjournald]
(root,0,0,00:08:05/1650-00:21:17,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1650-00:21:17,730) [xfs-cil/dm-5]
(root,0,0,00:07:46/1650-00:21:17,731) [xfssyncd/dm-5]
(root,0,0,11:53:27/1650-00:21:17,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1650-00:21:15,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1650-00:21:15,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1650-00:21:15,735) [xfssyncd/dm-7]
(root,0,0,08:51:58/1650-00:21:15,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1650-00:21:13,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1650-00:21:13,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1650-00:21:13,739) [xfssyncd/dm-6]
(root,0,0,08:52:17/1650-00:21:13,740) [xfsaild/dm-6]
(root,0,0,01:24:29/1650-00:20:54,816) [kauditd]
(root,93156,740,05:47:18/1650-00:20:40,1154) auditd
(root,249864,5540,03:16:52/1650-00:20:39,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:09/1650-00:20:38,1195) rpcbind
(rpcuser,23532,1184,00:00:00/1650-00:20:37,1215) rpc.statd
(dbus,21580,1000,00:00:08/1650-00:20:35,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1650-00:20:33,1285) hald
(root,20400,836,00:00:00/1650-00:20:33,1286) hald-runner
(root,452700,1136,00:39:35/1650-00:20:27,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:29:52/1650-00:20:22,1375) /usr/sbin/sshd
(root,21716,804,00:26:55/1650-00:20:21,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:15/1650-00:20:17,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:30/1650-00:20:09,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1650-00:20:08,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:45/1650-00:19:58,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1650-00:19:56,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1650-00:19:56,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1650-00:19:56,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443876,159324,10-08:32:26/1650-00:19:56,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:51/1650-00:19:36,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:12/1650-00:19:36,1759) inet_gethost 4
(root,112532,776,00:00:02/1650-00:19:35,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,610728,216552,01:39:29/1650-00:19:30,1776) /usr/sbin/httpd
(root,116864,704,00:14:15/1650-00:19:29,1786) crond
(root,21104,316,00:00:01/1650-00:19:29,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1650-00:19:29,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1650-00:19:29,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1650-00:19:29,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1650-00:19:29,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1650-00:19:29,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1650-00:19:29,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1650-00:19:29,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3360,00:00:00/01:16:31,4368) pickup -l -t fifo -u
(apache,612496,210588,00:00:00/5-07:23:18,6055) /usr/sbin/httpd
(root,0,0,00:00:28/31-07:30:18,11877) [flush-253:5]
(apache,612616,210900,00:00:00/4-15:04:20,13100) /usr/sbin/httpd
(apache,612496,210580,00:00:00/4-15:04:19,13107) /usr/sbin/httpd
(apache,612496,210880,00:00:00/4-15:04:19,13109) /usr/sbin/httpd
(apache,612616,210900,00:00:00/4-15:04:17,13117) /usr/sbin/httpd
(apache,612496,210916,00:00:00/4-15:04:10,13136) /usr/sbin/httpd
(apache,610728,206212,00:00:00/5-14:16:40,18547) /usr/sbin/httpd
(apache,612616,210936,00:00:00/5-14:16:39,18558) /usr/sbin/httpd
(apache,612496,210592,00:00:00/5-14:16:39,18567) /usr/sbin/httpd
(apache,612496,210928,00:00:00/5-14:16:39,18578) /usr/sbin/httpd
(apache,612616,210908,00:00:00/5-14:16:39,18588) /usr/sbin/httpd
(apache,612496,210652,00:00:00/5-14:16:39,18600) /usr/sbin/httpd
(apache,612496,210612,00:00:00/5-14:16:39,18611) /usr/sbin/httpd
(apache,612484,210628,00:00:00/5-14:16:39,18622) /usr/sbin/httpd
(apache,612616,210928,00:00:00/5-14:16:39,18634) /usr/sbin/httpd
(root,101292,4276,00:00:00/00:04,18784) sshd: root [priv]
(sshd,67568,1644,00:00:00/00:04,18785) sshd: root [net] 
(root,66224,3100,00:00:00/00:03,18786) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,18894) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,18912) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,18913) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,612496,210436,00:00:00/22:41:26,19844) /usr/sbin/httpd
(apache,612496,210424,00:00:00/22:41:23,19852) /usr/sbin/httpd
(root,108468,1060,00:00:00/847-08:32:14,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/847-08:32:14,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/847-08:32:14,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15876,2-22:57:05/847-08:32:14,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-13 23:00

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79391a2437c4

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:39:37/1648-00:42:19,1) /sbin/init
(root,0,0,00:00:05/1648-00:42:19,2) [kthreadd]
(root,0,0,00:15:14/1648-00:42:19,3) [migration/0]
(root,0,0,00:13:31/1648-00:42:19,4) [ksoftirqd/0]
(root,0,0,00:00:00/1648-00:42:19,5) [stopper/0]
(root,0,0,00:04:18/1648-00:42:19,6) [watchdog/0]
(root,0,0,00:23:05/1648-00:42:19,7) [migration/1]
(root,0,0,00:00:00/1648-00:42:19,8) [stopper/1]
(root,0,0,00:07:47/1648-00:42:19,9) [ksoftirqd/1]
(root,0,0,00:04:01/1648-00:42:19,10) [watchdog/1]
(root,0,0,02:56:40/1648-00:42:19,11) [events/0]
(root,0,0,03:08:37/1648-00:42:19,12) [events/1]
(root,0,0,00:00:00/1648-00:42:19,13) [cgroup]
(root,0,0,00:00:00/1648-00:42:19,14) [khelper]
(root,0,0,00:00:00/1648-00:42:19,15) [netns]
(root,0,0,00:00:00/1648-00:42:19,16) [async/mgr]
(root,0,0,00:00:00/1648-00:42:19,17) [pm]
(root,0,0,00:00:00/1648-00:42:19,18) [xenwatch]
(root,0,0,00:00:00/1648-00:42:19,19) [xenbus]
(root,0,0,00:09:25/1648-00:42:19,20) [sync_supers]
(root,0,0,00:11:11/1648-00:42:19,21) [bdi-default]
(root,0,0,00:00:00/1648-00:42:19,22) [kintegrityd/0]
(root,0,0,00:00:00/1648-00:42:19,23) [kintegrityd/1]
(root,0,0,00:09:55/1648-00:42:19,24) [kblockd/0]
(root,0,0,00:01:53/1648-00:42:19,25) [kblockd/1]
(root,0,0,00:00:00/1648-00:42:19,26) [ata_aux]
(root,0,0,00:00:00/1648-00:42:19,27) [ata_sff/0]
(root,0,0,00:00:00/1648-00:42:19,28) [ata_sff/1]
(root,0,0,00:00:00/1648-00:42:19,29) [ksuspend_usbd]
(root,0,0,00:00:00/1648-00:42:19,30) [khubd]
(root,0,0,00:00:00/1648-00:42:19,31) [kseriod]
(root,0,0,00:00:00/1648-00:42:19,32) [md/0]
(root,0,0,00:00:00/1648-00:42:19,33) [md/1]
(root,0,0,00:00:00/1648-00:42:19,34) [md_misc/0]
(root,0,0,00:00:00/1648-00:42:19,35) [md_misc/1]
(root,0,0,00:00:00/1648-00:42:19,36) [linkwatch]
(root,0,0,00:00:54/1648-00:42:19,37) [khungtaskd]
(root,0,0,00:00:09/1648-00:42:19,38) [kswapd0]
(root,0,0,00:00:00/1648-00:42:19,39) [ksmd]
(root,0,0,00:00:00/1648-00:42:19,40) [aio/0]
(root,0,0,00:00:00/1648-00:42:19,41) [aio/1]
(root,0,0,00:00:00/1648-00:42:19,42) [crypto/0]
(root,0,0,00:00:00/1648-00:42:19,43) [crypto/1]
(root,0,0,00:00:00/1648-00:42:19,51) [kthrotld/0]
(root,0,0,00:00:00/1648-00:42:19,52) [kthrotld/1]
(root,0,0,00:00:00/1648-00:42:19,54) [khvcd]
(root,0,0,00:00:00/1648-00:42:19,55) [kpsmoused]
(root,0,0,00:00:00/1648-00:42:19,56) [usbhid_resumer]
(root,0,0,00:00:00/1648-00:42:19,57) [deferwq]
(root,0,0,00:00:00/1648-00:42:19,89) [kdmremove]
(root,0,0,00:00:00/1648-00:42:19,90) [kstriped]
(root,0,0,00:00:00/1648-00:42:14,233) [kdmflush]
(root,0,0,00:00:00/1648-00:42:14,235) [kdmflush]
(root,0,0,00:00:30/1648-00:42:01,252) [kjournald]
(root,10936,368,00:00:00/1648-00:41:41,341) /sbin/udevd -d
(root,0,0,00:00:00/1648-00:41:26,610) [kdmflush]
(root,0,0,00:00:00/1648-00:41:26,613) [kdmflush]
(root,0,0,00:00:00/1648-00:41:26,616) [kdmflush]
(root,0,0,00:00:00/1648-00:41:26,621) [kdmflush]
(root,0,0,00:00:00/1648-00:41:26,627) [kdmflush]
(root,10932,472,00:00:00/1648-00:41:26,628) /sbin/udevd -d
(root,0,0,00:00:00/1648-00:41:26,631) [kdmflush]
(root,10932,436,00:00:00/1648-00:41:26,632) /sbin/udevd -d
(root,0,0,00:18:02/1648-00:41:14,702) [flush-253:4]
(root,0,0,00:00:00/1648-00:41:05,706) [kjournald]
(root,0,0,00:00:00/1648-00:41:04,709) [xfs_mru_cache]
(root,0,0,00:12:35/1648-00:41:04,710) [xfslogd/0]
(root,0,0,00:00:00/1648-00:41:04,711) [xfslogd/1]
(root,0,0,00:17:30/1648-00:41:04,712) [xfsdatad/0]
(root,0,0,00:00:00/1648-00:41:04,713) [xfsdatad/1]
(root,0,0,00:00:00/1648-00:41:04,714) [xfsconvertd/0]
(root,0,0,00:00:00/1648-00:41:04,715) [xfsconvertd/1]
(root,0,0,00:00:13/1648-00:41:04,716) [xfsalloc/0]
(root,0,0,00:00:38/1648-00:41:04,717) [xfsalloc/1]
(root,0,0,00:00:13/1648-00:41:04,718) [xfseofblocks/0]
(root,0,0,00:00:48/1648-00:41:04,719) [xfseofblocks/1]
(root,0,0,00:00:00/1648-00:41:04,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1648-00:41:04,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1648-00:41:04,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1648-00:41:03,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1648-00:41:01,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1648-00:41:01,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1648-00:41:01,726) [xfssyncd/dm-2]
(root,0,0,08:48:31/1648-00:41:00,727) [xfsaild/dm-2]
(root,0,0,00:18:35/1648-00:40:33,728) [kjournald]
(root,0,0,00:08:05/1648-00:40:32,729) [xfsbufd/dm-5]
(root,0,0,00:06:57/1648-00:40:32,730) [xfs-cil/dm-5]
(root,0,0,00:07:45/1648-00:40:32,731) [xfssyncd/dm-5]
(root,0,0,11:52:34/1648-00:40:32,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1648-00:40:30,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1648-00:40:30,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1648-00:40:30,735) [xfssyncd/dm-7]
(root,0,0,08:51:18/1648-00:40:30,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1648-00:40:28,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1648-00:40:28,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1648-00:40:28,739) [xfssyncd/dm-6]
(root,0,0,08:51:36/1648-00:40:28,740) [xfsaild/dm-6]
(root,0,0,01:24:09/1648-00:40:09,816) [kauditd]
(root,93156,740,05:46:34/1648-00:39:55,1154) auditd
(root,249864,5540,03:16:06/1648-00:39:54,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:09/1648-00:39:53,1195) rpcbind
(rpcuser,23532,1184,00:00:00/1648-00:39:52,1215) rpc.statd
(dbus,21580,1000,00:00:08/1648-00:39:50,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1648-00:39:48,1285) hald
(root,20400,836,00:00:00/1648-00:39:48,1286) hald-runner
(root,452700,1136,00:39:32/1648-00:39:42,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:28:14/1648-00:39:37,1375) /usr/sbin/sshd
(root,21716,804,00:26:53/1648-00:39:36,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:13/1648-00:39:32,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:29/1648-00:39:24,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1648-00:39:23,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:43/1648-00:39:13,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1648-00:39:11,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1648-00:39:11,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1648-00:39:11,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443364,159364,10-08:14:40/1648-00:39:11,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:51/1648-00:38:51,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:12/1648-00:38:51,1759) inet_gethost 4
(root,112532,776,00:00:02/1648-00:38:50,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,610728,216552,01:39:21/1648-00:38:45,1776) /usr/sbin/httpd
(root,116864,704,00:14:14/1648-00:38:44,1786) crond
(root,21104,316,00:00:01/1648-00:38:44,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1648-00:38:44,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1648-00:38:44,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1648-00:38:44,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1648-00:38:44,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1648-00:38:44,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1648-00:38:44,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1648-00:38:44,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,612496,210572,00:00:00/3-07:42:33,6055) /usr/sbin/httpd
(postfix,80944,3360,00:00:00/18:12,9904) pickup -l -t fifo -u
(root,0,0,00:00:26/29-07:49:33,11877) [flush-253:5]
(root,0,0,00:00:00/02:29,12600) [flush-253:1]
(root,98636,3784,00:00:00/00:05,12982) sshd: unknown [priv]
(sshd,67568,1744,00:00:00/00:04,12983) sshd: unknown [net]
(root,98636,3700,00:00:00/00:01,12984) sshd: unknown [priv]
(sshd,67568,1736,00:00:00/00:01,12985) sshd: unknown [net]
(root,110268,1488,00:00:00/00:01,13065) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,13083) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,13084) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,612616,210880,00:00:00/2-15:23:35,13100) /usr/sbin/httpd
(apache,612496,210552,00:00:00/2-15:23:34,13107) /usr/sbin/httpd
(apache,612496,210824,00:00:00/2-15:23:34,13109) /usr/sbin/httpd
(apache,612484,210568,00:00:00/2-15:23:32,13117) /usr/sbin/httpd
(apache,612496,210548,00:00:00/2-15:23:25,13136) /usr/sbin/httpd
(apache,610728,206212,00:00:00/3-14:35:55,18547) /usr/sbin/httpd
(apache,612616,210920,00:00:00/3-14:35:54,18558) /usr/sbin/httpd
(apache,612496,210564,00:00:00/3-14:35:54,18567) /usr/sbin/httpd
(apache,612496,210904,00:00:00/3-14:35:54,18578) /usr/sbin/httpd
(apache,612616,210880,00:00:00/3-14:35:54,18588) /usr/sbin/httpd
(apache,612496,210584,00:00:00/3-14:35:54,18600) /usr/sbin/httpd
(apache,612496,210580,00:00:00/3-14:35:54,18611) /usr/sbin/httpd
(apache,612484,210612,00:00:00/3-14:35:54,18622) /usr/sbin/httpd
(apache,612616,210924,00:00:00/3-14:35:54,18634) /usr/sbin/httpd
(root,108468,1060,00:00:00/845-08:51:29,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/845-08:51:29,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/845-08:51:29,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15156,2-22:45:33/845-08:51:29,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-11 23:19

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793960bb36a2

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:39:27/1646-01:11:10,1) /sbin/init
(root,0,0,00:00:05/1646-01:11:10,2) [kthreadd]
(root,0,0,00:15:13/1646-01:11:10,3) [migration/0]
(root,0,0,00:13:30/1646-01:11:10,4) [ksoftirqd/0]
(root,0,0,00:00:00/1646-01:11:10,5) [stopper/0]
(root,0,0,00:04:18/1646-01:11:10,6) [watchdog/0]
(root,0,0,00:23:02/1646-01:11:10,7) [migration/1]
(root,0,0,00:00:00/1646-01:11:10,8) [stopper/1]
(root,0,0,00:07:46/1646-01:11:10,9) [ksoftirqd/1]
(root,0,0,00:04:01/1646-01:11:10,10) [watchdog/1]
(root,0,0,02:56:28/1646-01:11:10,11) [events/0]
(root,0,0,03:08:22/1646-01:11:10,12) [events/1]
(root,0,0,00:00:00/1646-01:11:10,13) [cgroup]
(root,0,0,00:00:00/1646-01:11:10,14) [khelper]
(root,0,0,00:00:00/1646-01:11:10,15) [netns]
(root,0,0,00:00:00/1646-01:11:10,16) [async/mgr]
(root,0,0,00:00:00/1646-01:11:10,17) [pm]
(root,0,0,00:00:00/1646-01:11:10,18) [xenwatch]
(root,0,0,00:00:00/1646-01:11:10,19) [xenbus]
(root,0,0,00:09:24/1646-01:11:10,20) [sync_supers]
(root,0,0,00:11:10/1646-01:11:10,21) [bdi-default]
(root,0,0,00:00:00/1646-01:11:10,22) [kintegrityd/0]
(root,0,0,00:00:00/1646-01:11:10,23) [kintegrityd/1]
(root,0,0,00:09:55/1646-01:11:10,24) [kblockd/0]
(root,0,0,00:01:53/1646-01:11:10,25) [kblockd/1]
(root,0,0,00:00:00/1646-01:11:10,26) [ata_aux]
(root,0,0,00:00:00/1646-01:11:10,27) [ata_sff/0]
(root,0,0,00:00:00/1646-01:11:10,28) [ata_sff/1]
(root,0,0,00:00:00/1646-01:11:10,29) [ksuspend_usbd]
(root,0,0,00:00:00/1646-01:11:10,30) [khubd]
(root,0,0,00:00:00/1646-01:11:10,31) [kseriod]
(root,0,0,00:00:00/1646-01:11:10,32) [md/0]
(root,0,0,00:00:00/1646-01:11:10,33) [md/1]
(root,0,0,00:00:00/1646-01:11:10,34) [md_misc/0]
(root,0,0,00:00:00/1646-01:11:10,35) [md_misc/1]
(root,0,0,00:00:00/1646-01:11:10,36) [linkwatch]
(root,0,0,00:00:54/1646-01:11:10,37) [khungtaskd]
(root,0,0,00:00:09/1646-01:11:10,38) [kswapd0]
(root,0,0,00:00:00/1646-01:11:10,39) [ksmd]
(root,0,0,00:00:00/1646-01:11:10,40) [aio/0]
(root,0,0,00:00:00/1646-01:11:10,41) [aio/1]
(root,0,0,00:00:00/1646-01:11:10,42) [crypto/0]
(root,0,0,00:00:00/1646-01:11:10,43) [crypto/1]
(root,0,0,00:00:00/1646-01:11:10,51) [kthrotld/0]
(root,0,0,00:00:00/1646-01:11:10,52) [kthrotld/1]
(root,0,0,00:00:00/1646-01:11:10,54) [khvcd]
(root,0,0,00:00:00/1646-01:11:10,55) [kpsmoused]
(root,0,0,00:00:00/1646-01:11:10,56) [usbhid_resumer]
(root,0,0,00:00:00/1646-01:11:10,57) [deferwq]
(root,0,0,00:00:00/1646-01:11:10,89) [kdmremove]
(root,0,0,00:00:00/1646-01:11:10,90) [kstriped]
(root,0,0,00:00:00/1646-01:11:05,233) [kdmflush]
(root,0,0,00:00:00/1646-01:11:05,235) [kdmflush]
(root,0,0,00:00:30/1646-01:10:52,252) [kjournald]
(root,10936,368,00:00:00/1646-01:10:32,341) /sbin/udevd -d
(root,0,0,00:00:00/1646-01:10:17,610) [kdmflush]
(root,0,0,00:00:00/1646-01:10:17,613) [kdmflush]
(root,0,0,00:00:00/1646-01:10:17,616) [kdmflush]
(root,0,0,00:00:00/1646-01:10:17,621) [kdmflush]
(root,0,0,00:00:00/1646-01:10:17,627) [kdmflush]
(root,10932,472,00:00:00/1646-01:10:17,628) /sbin/udevd -d
(root,0,0,00:00:00/1646-01:10:17,631) [kdmflush]
(root,10932,436,00:00:00/1646-01:10:17,632) /sbin/udevd -d
(root,0,0,00:18:01/1646-01:10:05,702) [flush-253:4]
(root,0,0,00:00:00/1646-01:09:56,706) [kjournald]
(root,0,0,00:00:00/1646-01:09:55,709) [xfs_mru_cache]
(root,0,0,00:12:35/1646-01:09:55,710) [xfslogd/0]
(root,0,0,00:00:00/1646-01:09:55,711) [xfslogd/1]
(root,0,0,00:17:30/1646-01:09:55,712) [xfsdatad/0]
(root,0,0,00:00:00/1646-01:09:55,713) [xfsdatad/1]
(root,0,0,00:00:00/1646-01:09:55,714) [xfsconvertd/0]
(root,0,0,00:00:00/1646-01:09:55,715) [xfsconvertd/1]
(root,0,0,00:00:13/1646-01:09:55,716) [xfsalloc/0]
(root,0,0,00:00:38/1646-01:09:55,717) [xfsalloc/1]
(root,0,0,00:00:13/1646-01:09:55,718) [xfseofblocks/0]
(root,0,0,00:00:48/1646-01:09:55,719) [xfseofblocks/1]
(root,0,0,00:00:00/1646-01:09:55,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1646-01:09:55,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1646-01:09:55,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1646-01:09:54,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1646-01:09:52,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1646-01:09:52,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1646-01:09:52,726) [xfssyncd/dm-2]
(root,0,0,08:47:52/1646-01:09:51,727) [xfsaild/dm-2]
(root,0,0,00:18:34/1646-01:09:24,728) [kjournald]
(root,0,0,00:08:05/1646-01:09:23,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1646-01:09:23,730) [xfs-cil/dm-5]
(root,0,0,00:07:45/1646-01:09:23,731) [xfssyncd/dm-5]
(root,0,0,11:51:40/1646-01:09:23,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1646-01:09:21,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1646-01:09:21,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1646-01:09:21,735) [xfssyncd/dm-7]
(root,0,0,08:50:38/1646-01:09:21,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1646-01:09:19,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1646-01:09:19,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1646-01:09:19,739) [xfssyncd/dm-6]
(root,0,0,08:50:57/1646-01:09:19,740) [xfsaild/dm-6]
(root,0,0,01:23:48/1646-01:09:00,816) [kauditd]
(root,93156,740,05:45:46/1646-01:08:46,1154) auditd
(root,249864,5540,03:15:16/1646-01:08:45,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:08/1646-01:08:44,1195) rpcbind
(rpcuser,23532,1184,00:00:00/1646-01:08:43,1215) rpc.statd
(dbus,21580,1000,00:00:08/1646-01:08:41,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1646-01:08:39,1285) hald
(root,20400,836,00:00:00/1646-01:08:39,1286) hald-runner
(root,452700,1136,00:39:30/1646-01:08:33,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:26:24/1646-01:08:28,1375) /usr/sbin/sshd
(root,21716,804,00:26:51/1646-01:08:27,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:11/1646-01:08:23,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:28/1646-01:08:15,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1646-01:08:14,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:41/1646-01:08:04,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1646-01:08:02,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1646-01:08:02,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1646-01:08:02,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1542160,226496,10-07:56:04/1646-01:08:02,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:51/1646-01:07:42,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:12/1646-01:07:42,1759) inet_gethost 4
(root,112532,776,00:00:02/1646-01:07:41,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,610728,216552,01:39:13/1646-01:07:36,1776) /usr/sbin/httpd
(root,116864,704,00:14:13/1646-01:07:35,1786) crond
(root,21104,316,00:00:01/1646-01:07:35,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1646-01:07:35,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1646-01:07:35,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1646-01:07:35,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1646-01:07:35,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1646-01:07:35,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1646-01:07:35,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1646-01:07:35,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,612496,210528,00:00:00/1-08:11:24,6055) /usr/sbin/httpd
(postfix,80944,3360,00:00:00/01:09:33,8582) pickup -l -t fifo -u
(root,0,0,00:00:25/27-08:18:24,11877) [flush-253:5]
(apache,612616,210708,00:00:00/15:52:26,13100) /usr/sbin/httpd
(apache,612496,210440,00:00:00/15:52:25,13107) /usr/sbin/httpd
(apache,612496,210720,00:00:00/15:52:25,13109) /usr/sbin/httpd
(apache,612484,210448,00:00:00/15:52:23,13117) /usr/sbin/httpd
(apache,612496,210400,00:00:00/15:52:16,13136) /usr/sbin/httpd
(apache,610728,206212,00:00:00/1-15:04:46,18547) /usr/sbin/httpd
(apache,612616,210888,00:00:00/1-15:04:45,18558) /usr/sbin/httpd
(apache,612496,210532,00:00:00/1-15:04:45,18567) /usr/sbin/httpd
(apache,612496,210848,00:00:00/1-15:04:45,18578) /usr/sbin/httpd
(apache,612616,210864,00:00:00/1-15:04:45,18588) /usr/sbin/httpd
(apache,612496,210532,00:00:00/1-15:04:45,18600) /usr/sbin/httpd
(apache,612496,210528,00:00:00/1-15:04:45,18611) /usr/sbin/httpd
(apache,612484,210580,00:00:00/1-15:04:45,18622) /usr/sbin/httpd
(apache,612616,210872,00:00:00/1-15:04:45,18634) /usr/sbin/httpd
(root,108468,1060,00:00:00/843-09:20:20,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/843-09:20:20,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/843-09:20:20,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15924,2-22:34:01/843-09:20:20,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/02:01,23257) [flush-253:1]
(root,67568,3168,00:00:00/01:49,23278) sshd: [accepted] 
(sshd,67568,1400,00:00:00/01:48,23281) sshd: [net]      
(root,67568,3164,00:00:00/01:32,23311) sshd: [accepted] 
(sshd,67568,1392,00:00:00/01:31,23316) sshd: [net]      
(root,67568,3168,00:00:00/01:01,23464) sshd: [accepted] 
(sshd,67568,1396,00:00:00/01:00,23467) sshd: [net]      
(root,67568,3168,00:00:00/00:25,23536) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:24,23538) sshd: [net]      
(root,98636,3776,00:00:00/00:06,23666) sshd: nfsnobody [priv]
(sshd,67568,1652,00:00:00/00:06,23667) sshd: nfsnobody [net]
(root,67568,3168,00:00:00/00:02,23668) sshd: [accepted] 
(root,66224,3100,00:00:00/00:01,23669) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:01,23672) sshd: [net]      
(root,66224,3104,00:00:00/00:01,23673) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,23691) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:00,23709) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:00,23710) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-09 23:48

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793940c8b1da

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:39:12/1644-00:45:17,1) /sbin/init
(root,0,0,00:00:05/1644-00:45:17,2) [kthreadd]
(root,0,0,00:15:12/1644-00:45:17,3) [migration/0]
(root,0,0,00:13:28/1644-00:45:17,4) [ksoftirqd/0]
(root,0,0,00:00:00/1644-00:45:17,5) [stopper/0]
(root,0,0,00:04:18/1644-00:45:17,6) [watchdog/0]
(root,0,0,00:22:58/1644-00:45:17,7) [migration/1]
(root,0,0,00:00:00/1644-00:45:17,8) [stopper/1]
(root,0,0,00:07:45/1644-00:45:17,9) [ksoftirqd/1]
(root,0,0,00:04:00/1644-00:45:17,10) [watchdog/1]
(root,0,0,02:56:16/1644-00:45:17,11) [events/0]
(root,0,0,03:08:06/1644-00:45:17,12) [events/1]
(root,0,0,00:00:00/1644-00:45:17,13) [cgroup]
(root,0,0,00:00:00/1644-00:45:17,14) [khelper]
(root,0,0,00:00:00/1644-00:45:17,15) [netns]
(root,0,0,00:00:00/1644-00:45:17,16) [async/mgr]
(root,0,0,00:00:00/1644-00:45:17,17) [pm]
(root,0,0,00:00:00/1644-00:45:17,18) [xenwatch]
(root,0,0,00:00:00/1644-00:45:17,19) [xenbus]
(root,0,0,00:09:24/1644-00:45:17,20) [sync_supers]
(root,0,0,00:11:09/1644-00:45:17,21) [bdi-default]
(root,0,0,00:00:00/1644-00:45:17,22) [kintegrityd/0]
(root,0,0,00:00:00/1644-00:45:17,23) [kintegrityd/1]
(root,0,0,00:09:54/1644-00:45:17,24) [kblockd/0]
(root,0,0,00:01:53/1644-00:45:17,25) [kblockd/1]
(root,0,0,00:00:00/1644-00:45:17,26) [ata_aux]
(root,0,0,00:00:00/1644-00:45:17,27) [ata_sff/0]
(root,0,0,00:00:00/1644-00:45:17,28) [ata_sff/1]
(root,0,0,00:00:00/1644-00:45:17,29) [ksuspend_usbd]
(root,0,0,00:00:00/1644-00:45:17,30) [khubd]
(root,0,0,00:00:00/1644-00:45:17,31) [kseriod]
(root,0,0,00:00:00/1644-00:45:17,32) [md/0]
(root,0,0,00:00:00/1644-00:45:17,33) [md/1]
(root,0,0,00:00:00/1644-00:45:17,34) [md_misc/0]
(root,0,0,00:00:00/1644-00:45:17,35) [md_misc/1]
(root,0,0,00:00:00/1644-00:45:17,36) [linkwatch]
(root,0,0,00:00:54/1644-00:45:17,37) [khungtaskd]
(root,0,0,00:00:09/1644-00:45:17,38) [kswapd0]
(root,0,0,00:00:00/1644-00:45:17,39) [ksmd]
(root,0,0,00:00:00/1644-00:45:17,40) [aio/0]
(root,0,0,00:00:00/1644-00:45:17,41) [aio/1]
(root,0,0,00:00:00/1644-00:45:17,42) [crypto/0]
(root,0,0,00:00:00/1644-00:45:17,43) [crypto/1]
(root,0,0,00:00:00/1644-00:45:17,51) [kthrotld/0]
(root,0,0,00:00:00/1644-00:45:17,52) [kthrotld/1]
(root,0,0,00:00:00/1644-00:45:17,54) [khvcd]
(root,0,0,00:00:00/1644-00:45:17,55) [kpsmoused]
(root,0,0,00:00:00/1644-00:45:17,56) [usbhid_resumer]
(root,0,0,00:00:00/1644-00:45:17,57) [deferwq]
(root,0,0,00:00:00/1644-00:45:17,89) [kdmremove]
(root,0,0,00:00:00/1644-00:45:17,90) [kstriped]
(root,0,0,00:00:00/1644-00:45:12,233) [kdmflush]
(root,0,0,00:00:00/1644-00:45:12,235) [kdmflush]
(root,0,0,00:00:30/1644-00:44:59,252) [kjournald]
(root,10936,368,00:00:00/1644-00:44:39,341) /sbin/udevd -d
(root,0,0,00:00:00/1644-00:44:24,610) [kdmflush]
(root,0,0,00:00:00/1644-00:44:24,613) [kdmflush]
(root,0,0,00:00:00/1644-00:44:24,616) [kdmflush]
(root,0,0,00:00:00/1644-00:44:24,621) [kdmflush]
(root,0,0,00:00:00/1644-00:44:24,627) [kdmflush]
(root,10932,472,00:00:00/1644-00:44:24,628) /sbin/udevd -d
(root,0,0,00:00:00/1644-00:44:24,631) [kdmflush]
(root,10932,436,00:00:00/1644-00:44:24,632) /sbin/udevd -d
(root,0,0,00:17:59/1644-00:44:12,702) [flush-253:4]
(root,0,0,00:00:00/1644-00:44:03,706) [kjournald]
(root,0,0,00:00:00/1644-00:44:02,709) [xfs_mru_cache]
(root,0,0,00:12:35/1644-00:44:02,710) [xfslogd/0]
(root,0,0,00:00:00/1644-00:44:02,711) [xfslogd/1]
(root,0,0,00:17:29/1644-00:44:02,712) [xfsdatad/0]
(root,0,0,00:00:00/1644-00:44:02,713) [xfsdatad/1]
(root,0,0,00:00:00/1644-00:44:02,714) [xfsconvertd/0]
(root,0,0,00:00:00/1644-00:44:02,715) [xfsconvertd/1]
(root,0,0,00:00:13/1644-00:44:02,716) [xfsalloc/0]
(root,0,0,00:00:38/1644-00:44:02,717) [xfsalloc/1]
(root,0,0,00:00:13/1644-00:44:02,718) [xfseofblocks/0]
(root,0,0,00:00:48/1644-00:44:02,719) [xfseofblocks/1]
(root,0,0,00:00:00/1644-00:44:02,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1644-00:44:02,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1644-00:44:02,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1644-00:44:01,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1644-00:43:59,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1644-00:43:59,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1644-00:43:59,726) [xfssyncd/dm-2]
(root,0,0,08:47:12/1644-00:43:58,727) [xfsaild/dm-2]
(root,0,0,00:18:32/1644-00:43:31,728) [kjournald]
(root,0,0,00:08:05/1644-00:43:30,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1644-00:43:30,730) [xfs-cil/dm-5]
(root,0,0,00:07:44/1644-00:43:30,731) [xfssyncd/dm-5]
(root,0,0,11:50:45/1644-00:43:30,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1644-00:43:28,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1644-00:43:28,734) [xfs-cil/dm-7]
(root,0,0,00:01:55/1644-00:43:28,735) [xfssyncd/dm-7]
(root,0,0,08:49:57/1644-00:43:28,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1644-00:43:26,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1644-00:43:26,738) [xfs-cil/dm-6]
(root,0,0,00:01:58/1644-00:43:26,739) [xfssyncd/dm-6]
(root,0,0,08:50:16/1644-00:43:26,740) [xfsaild/dm-6]
(root,0,0,01:23:17/1644-00:43:07,816) [kauditd]
(root,93156,740,05:44:36/1644-00:42:53,1154) auditd
(root,249864,5540,03:14:07/1644-00:42:52,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:08/1644-00:42:51,1195) rpcbind
(rpcuser,23536,1180,00:00:00/1644-00:42:50,1215) rpc.statd
(dbus,21580,1000,00:00:08/1644-00:42:48,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1644-00:42:46,1285) hald
(root,20400,836,00:00:00/1644-00:42:46,1286) hald-runner
(root,452700,1136,00:39:27/1644-00:42:40,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:23:40/1644-00:42:35,1375) /usr/sbin/sshd
(root,21716,804,00:26:49/1644-00:42:34,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:08/1644-00:42:30,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:28/1644-00:42:22,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1644-00:42:21,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:39/1644-00:42:11,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1644-00:42:09,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1644-00:42:09,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1644-00:42:09,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1442580,159008,10-07:37:47/1644-00:42:09,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:51/1644-00:41:49,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:11/1644-00:41:49,1759) inet_gethost 4
(root,112532,776,00:00:02/1644-00:41:48,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609936,215708,01:39:04/1644-00:41:43,1776) /usr/sbin/httpd
(root,116864,704,00:14:12/1644-00:41:42,1786) crond
(root,21104,316,00:00:01/1644-00:41:42,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1644-00:41:42,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1644-00:41:42,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1644-00:41:42,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1644-00:41:42,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1644-00:41:42,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1644-00:41:42,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1644-00:41:42,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,611652,209812,00:00:00/6-03:33:27,8557) /usr/sbin/httpd
(apache,609936,205364,00:00:00/6-14:47:57,10242) /usr/sbin/httpd
(apache,611652,209812,00:00:00/6-14:47:57,10252) /usr/sbin/httpd
(apache,611644,209832,00:00:00/6-14:47:56,10257) /usr/sbin/httpd
(apache,611652,209816,00:00:00/6-14:47:56,10258) /usr/sbin/httpd
(apache,611652,209768,00:00:00/6-14:47:56,10267) /usr/sbin/httpd
(apache,611644,209784,00:00:00/6-14:47:56,10279) /usr/sbin/httpd
(apache,611652,209760,00:00:00/6-14:47:56,10298) /usr/sbin/httpd
(apache,611644,209780,00:00:00/6-14:47:56,10307) /usr/sbin/httpd
(apache,611652,209820,00:00:00/6-14:47:56,10318) /usr/sbin/httpd
(root,0,0,00:00:23/25-07:52:31,11877) [flush-253:5]
(apache,611652,209792,00:00:00/6-03:00:30,14479) /usr/sbin/httpd
(apache,611652,209800,00:00:00/6-03:00:25,14486) /usr/sbin/httpd
(apache,611652,209760,00:00:00/6-03:00:12,14599) /usr/sbin/httpd
(apache,611652,209788,00:00:00/6-03:00:10,14603) /usr/sbin/httpd
(apache,611652,209800,00:00:00/6-03:00:06,14611) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/01:06:13,15809) pickup -l -t fifo -u
(root,108468,1060,00:00:00/841-08:54:27,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/841-08:54:27,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/841-08:54:27,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15136,2-22:23:35/841-08:54:27,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,67568,3224,00:00:00/00:58,29427) sshd: [accepted] 
(sshd,67568,1524,00:00:00/00:58,29428) sshd: [net]      
(root,66224,3100,00:00:00/00:36,29473) sshd: [accepted] 
(root,101428,4392,00:00:00/00:13,29607) sshd: root [priv]
(sshd,67568,1648,00:00:00/00:13,29608) sshd: root [net] 
(root,98636,3792,00:00:00/00:09,29616) sshd: webalizer [priv]
(sshd,67568,1656,00:00:00/00:08,29618) sshd: webalizer [net]
(root,98636,3792,00:00:00/00:06,29619) sshd: unknown [priv]
(sshd,67568,1744,00:00:00/00:05,29622) sshd: unknown [net]
(root,98636,3780,00:00:00/00:04,29625) sshd: adm [priv] 
(sshd,67568,1656,00:00:00/00:04,29626) sshd: adm [net]  
(root,67568,3248,00:00:00/00:02,29627) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:02,29628) sshd: [net]      
(root,67568,3164,00:00:00/00:02,29629) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:01,29706) sshd: [net]      
(root,110268,1492,00:00:00/00:01,29707) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,29725) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,804,00:00:00/00:01,29726) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-07 23:22

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939f68f4955

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:38:59/1642-01:11:43,1) /sbin/init
(root,0,0,00:00:05/1642-01:11:43,2) [kthreadd]
(root,0,0,00:15:11/1642-01:11:43,3) [migration/0]
(root,0,0,00:13:28/1642-01:11:43,4) [ksoftirqd/0]
(root,0,0,00:00:00/1642-01:11:43,5) [stopper/0]
(root,0,0,00:04:17/1642-01:11:43,6) [watchdog/0]
(root,0,0,00:22:55/1642-01:11:43,7) [migration/1]
(root,0,0,00:00:00/1642-01:11:43,8) [stopper/1]
(root,0,0,00:07:45/1642-01:11:43,9) [ksoftirqd/1]
(root,0,0,00:04:00/1642-01:11:43,10) [watchdog/1]
(root,0,0,02:56:04/1642-01:11:43,11) [events/0]
(root,0,0,03:07:51/1642-01:11:43,12) [events/1]
(root,0,0,00:00:00/1642-01:11:43,13) [cgroup]
(root,0,0,00:00:00/1642-01:11:43,14) [khelper]
(root,0,0,00:00:00/1642-01:11:43,15) [netns]
(root,0,0,00:00:00/1642-01:11:43,16) [async/mgr]
(root,0,0,00:00:00/1642-01:11:43,17) [pm]
(root,0,0,00:00:00/1642-01:11:43,18) [xenwatch]
(root,0,0,00:00:00/1642-01:11:43,19) [xenbus]
(root,0,0,00:09:23/1642-01:11:43,20) [sync_supers]
(root,0,0,00:11:09/1642-01:11:43,21) [bdi-default]
(root,0,0,00:00:00/1642-01:11:43,22) [kintegrityd/0]
(root,0,0,00:00:00/1642-01:11:43,23) [kintegrityd/1]
(root,0,0,00:09:54/1642-01:11:43,24) [kblockd/0]
(root,0,0,00:01:52/1642-01:11:43,25) [kblockd/1]
(root,0,0,00:00:00/1642-01:11:43,26) [ata_aux]
(root,0,0,00:00:00/1642-01:11:43,27) [ata_sff/0]
(root,0,0,00:00:00/1642-01:11:43,28) [ata_sff/1]
(root,0,0,00:00:00/1642-01:11:43,29) [ksuspend_usbd]
(root,0,0,00:00:00/1642-01:11:43,30) [khubd]
(root,0,0,00:00:00/1642-01:11:43,31) [kseriod]
(root,0,0,00:00:00/1642-01:11:43,32) [md/0]
(root,0,0,00:00:00/1642-01:11:43,33) [md/1]
(root,0,0,00:00:00/1642-01:11:43,34) [md_misc/0]
(root,0,0,00:00:00/1642-01:11:43,35) [md_misc/1]
(root,0,0,00:00:00/1642-01:11:43,36) [linkwatch]
(root,0,0,00:00:54/1642-01:11:43,37) [khungtaskd]
(root,0,0,00:00:08/1642-01:11:43,38) [kswapd0]
(root,0,0,00:00:00/1642-01:11:43,39) [ksmd]
(root,0,0,00:00:00/1642-01:11:43,40) [aio/0]
(root,0,0,00:00:00/1642-01:11:43,41) [aio/1]
(root,0,0,00:00:00/1642-01:11:43,42) [crypto/0]
(root,0,0,00:00:00/1642-01:11:43,43) [crypto/1]
(root,0,0,00:00:00/1642-01:11:43,51) [kthrotld/0]
(root,0,0,00:00:00/1642-01:11:43,52) [kthrotld/1]
(root,0,0,00:00:00/1642-01:11:43,54) [khvcd]
(root,0,0,00:00:00/1642-01:11:43,55) [kpsmoused]
(root,0,0,00:00:00/1642-01:11:43,56) [usbhid_resumer]
(root,0,0,00:00:00/1642-01:11:43,57) [deferwq]
(root,0,0,00:00:00/1642-01:11:43,89) [kdmremove]
(root,0,0,00:00:00/1642-01:11:43,90) [kstriped]
(root,0,0,00:00:00/1642-01:11:38,233) [kdmflush]
(root,0,0,00:00:00/1642-01:11:38,235) [kdmflush]
(root,0,0,00:00:30/1642-01:11:25,252) [kjournald]
(root,10936,368,00:00:00/1642-01:11:05,341) /sbin/udevd -d
(root,0,0,00:00:00/1642-01:10:50,610) [kdmflush]
(root,0,0,00:00:00/1642-01:10:50,613) [kdmflush]
(root,0,0,00:00:00/1642-01:10:50,616) [kdmflush]
(root,0,0,00:00:00/1642-01:10:50,621) [kdmflush]
(root,0,0,00:00:00/1642-01:10:50,627) [kdmflush]
(root,10932,472,00:00:00/1642-01:10:50,628) /sbin/udevd -d
(root,0,0,00:00:00/1642-01:10:50,631) [kdmflush]
(root,10932,436,00:00:00/1642-01:10:50,632) /sbin/udevd -d
(root,0,0,00:17:58/1642-01:10:38,702) [flush-253:4]
(root,0,0,00:00:00/1642-01:10:29,706) [kjournald]
(root,0,0,00:00:00/1642-01:10:28,709) [xfs_mru_cache]
(root,0,0,00:12:34/1642-01:10:28,710) [xfslogd/0]
(root,0,0,00:00:00/1642-01:10:28,711) [xfslogd/1]
(root,0,0,00:17:28/1642-01:10:28,712) [xfsdatad/0]
(root,0,0,00:00:00/1642-01:10:28,713) [xfsdatad/1]
(root,0,0,00:00:00/1642-01:10:28,714) [xfsconvertd/0]
(root,0,0,00:00:00/1642-01:10:28,715) [xfsconvertd/1]
(root,0,0,00:00:13/1642-01:10:28,716) [xfsalloc/0]
(root,0,0,00:00:38/1642-01:10:28,717) [xfsalloc/1]
(root,0,0,00:00:13/1642-01:10:28,718) [xfseofblocks/0]
(root,0,0,00:00:48/1642-01:10:28,719) [xfseofblocks/1]
(root,0,0,00:00:00/1642-01:10:28,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1642-01:10:28,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1642-01:10:28,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1642-01:10:27,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1642-01:10:25,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1642-01:10:25,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1642-01:10:25,726) [xfssyncd/dm-2]
(root,0,0,08:46:36/1642-01:10:24,727) [xfsaild/dm-2]
(root,0,0,00:18:31/1642-01:09:57,728) [kjournald]
(root,0,0,00:08:04/1642-01:09:56,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1642-01:09:56,730) [xfs-cil/dm-5]
(root,0,0,00:07:44/1642-01:09:56,731) [xfssyncd/dm-5]
(root,0,0,11:49:51/1642-01:09:56,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1642-01:09:54,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1642-01:09:54,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1642-01:09:54,735) [xfssyncd/dm-7]
(root,0,0,08:49:20/1642-01:09:54,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1642-01:09:52,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1642-01:09:52,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1642-01:09:52,739) [xfssyncd/dm-6]
(root,0,0,08:49:38/1642-01:09:52,740) [xfsaild/dm-6]
(root,0,0,01:22:49/1642-01:09:33,816) [kauditd]
(root,93156,740,05:43:36/1642-01:09:19,1154) auditd
(root,249864,5540,03:13:07/1642-01:09:18,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:08/1642-01:09:17,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1642-01:09:16,1215) rpc.statd
(dbus,21580,1000,00:00:08/1642-01:09:14,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1642-01:09:12,1285) hald
(root,20400,836,00:00:00/1642-01:09:12,1286) hald-runner
(root,452700,1136,00:39:24/1642-01:09:06,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:21:17/1642-01:09:01,1375) /usr/sbin/sshd
(root,21716,804,00:26:47/1642-01:09:00,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:06/1642-01:08:56,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:27/1642-01:08:48,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1642-01:08:47,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:37/1642-01:08:37,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1642-01:08:35,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1642-01:08:35,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1642-01:08:35,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,160288,10-07:19:40/1642-01:08:35,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:51/1642-01:08:15,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:11/1642-01:08:15,1759) inet_gethost 4
(root,112532,776,00:00:02/1642-01:08:14,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609936,215708,01:38:56/1642-01:08:09,1776) /usr/sbin/httpd
(root,116864,704,00:14:11/1642-01:08:08,1786) crond
(root,21104,316,00:00:01/1642-01:08:08,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1642-01:08:08,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1642-01:08:08,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1642-01:08:08,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1642-01:08:08,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1642-01:08:08,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1642-01:08:08,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1642-01:08:08,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,611652,209748,00:00:00/4-03:59:53,8557) /usr/sbin/httpd
(apache,609936,205364,00:00:00/4-15:14:23,10242) /usr/sbin/httpd
(apache,611652,209804,00:00:00/4-15:14:23,10252) /usr/sbin/httpd
(apache,611644,209820,00:00:00/4-15:14:22,10257) /usr/sbin/httpd
(apache,611652,209756,00:00:00/4-15:14:22,10258) /usr/sbin/httpd
(apache,611652,209748,00:00:00/4-15:14:22,10267) /usr/sbin/httpd
(apache,611644,209760,00:00:00/4-15:14:22,10279) /usr/sbin/httpd
(apache,611652,209736,00:00:00/4-15:14:22,10298) /usr/sbin/httpd
(apache,611644,209780,00:00:00/4-15:14:22,10307) /usr/sbin/httpd
(apache,611652,209764,00:00:00/4-15:14:22,10318) /usr/sbin/httpd
(root,0,0,00:00:21/23-08:18:57,11877) [flush-253:5]
(postfix,80944,3360,00:00:00/15:08,13211) pickup -l -t fifo -u
(apache,611652,209764,00:00:00/4-03:26:56,14479) /usr/sbin/httpd
(apache,611652,209784,00:00:00/4-03:26:51,14486) /usr/sbin/httpd
(apache,611652,209756,00:00:00/4-03:26:38,14599) /usr/sbin/httpd
(apache,611652,209744,00:00:00/4-03:26:36,14603) /usr/sbin/httpd
(apache,611652,209788,00:00:00/4-03:26:32,14611) /usr/sbin/httpd
(root,101428,4388,00:00:00/00:16,16095) sshd: root [priv]
(sshd,67568,1628,00:00:00/00:16,16096) sshd: root [net] 
(root,101288,4264,00:00:00/00:07,16109) sshd: root [priv]
(sshd,67568,1652,00:00:00/00:06,16110) sshd: root [net] 
(root,67568,3244,00:00:00/00:03,16111) sshd: [accepted] 
(root,67568,3164,00:00:00/00:02,16114) sshd: [accepted] 
(sshd,67568,1568,00:00:00/00:02,16115) sshd: [net]      
(sshd,67568,1400,00:00:00/00:01,16118) sshd: [net]      
(root,110268,1488,00:00:00/00:01,16157) /bin/bash /usr/bin/check_mk_agent
(root,13368,968,00:00:00/00:01,16175) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,804,00:00:00/00:01,16176) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/839-09:20:53,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/839-09:20:53,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/839-09:20:53,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15584,2-22:18:54/839-09:20:53,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-05 23:48

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939b8b2c317

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:38:48/1640-01:13:03,1) /sbin/init
(root,0,0,00:00:05/1640-01:13:03,2) [kthreadd]
(root,0,0,00:15:10/1640-01:13:03,3) [migration/0]
(root,0,0,00:13:27/1640-01:13:03,4) [ksoftirqd/0]
(root,0,0,00:00:00/1640-01:13:03,5) [stopper/0]
(root,0,0,00:04:17/1640-01:13:03,6) [watchdog/0]
(root,0,0,00:22:52/1640-01:13:03,7) [migration/1]
(root,0,0,00:00:00/1640-01:13:03,8) [stopper/1]
(root,0,0,00:07:44/1640-01:13:03,9) [ksoftirqd/1]
(root,0,0,00:04:00/1640-01:13:03,10) [watchdog/1]
(root,0,0,02:55:51/1640-01:13:03,11) [events/0]
(root,0,0,03:07:36/1640-01:13:03,12) [events/1]
(root,0,0,00:00:00/1640-01:13:03,13) [cgroup]
(root,0,0,00:00:00/1640-01:13:03,14) [khelper]
(root,0,0,00:00:00/1640-01:13:03,15) [netns]
(root,0,0,00:00:00/1640-01:13:03,16) [async/mgr]
(root,0,0,00:00:00/1640-01:13:03,17) [pm]
(root,0,0,00:00:00/1640-01:13:03,18) [xenwatch]
(root,0,0,00:00:00/1640-01:13:03,19) [xenbus]
(root,0,0,00:09:22/1640-01:13:03,20) [sync_supers]
(root,0,0,00:11:08/1640-01:13:03,21) [bdi-default]
(root,0,0,00:00:00/1640-01:13:03,22) [kintegrityd/0]
(root,0,0,00:00:00/1640-01:13:03,23) [kintegrityd/1]
(root,0,0,00:09:53/1640-01:13:03,24) [kblockd/0]
(root,0,0,00:01:52/1640-01:13:03,25) [kblockd/1]
(root,0,0,00:00:00/1640-01:13:03,26) [ata_aux]
(root,0,0,00:00:00/1640-01:13:03,27) [ata_sff/0]
(root,0,0,00:00:00/1640-01:13:03,28) [ata_sff/1]
(root,0,0,00:00:00/1640-01:13:03,29) [ksuspend_usbd]
(root,0,0,00:00:00/1640-01:13:03,30) [khubd]
(root,0,0,00:00:00/1640-01:13:03,31) [kseriod]
(root,0,0,00:00:00/1640-01:13:03,32) [md/0]
(root,0,0,00:00:00/1640-01:13:03,33) [md/1]
(root,0,0,00:00:00/1640-01:13:03,34) [md_misc/0]
(root,0,0,00:00:00/1640-01:13:03,35) [md_misc/1]
(root,0,0,00:00:00/1640-01:13:03,36) [linkwatch]
(root,0,0,00:00:53/1640-01:13:03,37) [khungtaskd]
(root,0,0,00:00:08/1640-01:13:03,38) [kswapd0]
(root,0,0,00:00:00/1640-01:13:03,39) [ksmd]
(root,0,0,00:00:00/1640-01:13:03,40) [aio/0]
(root,0,0,00:00:00/1640-01:13:03,41) [aio/1]
(root,0,0,00:00:00/1640-01:13:03,42) [crypto/0]
(root,0,0,00:00:00/1640-01:13:03,43) [crypto/1]
(root,0,0,00:00:00/1640-01:13:03,51) [kthrotld/0]
(root,0,0,00:00:00/1640-01:13:03,52) [kthrotld/1]
(root,0,0,00:00:00/1640-01:13:03,54) [khvcd]
(root,0,0,00:00:00/1640-01:13:03,55) [kpsmoused]
(root,0,0,00:00:00/1640-01:13:03,56) [usbhid_resumer]
(root,0,0,00:00:00/1640-01:13:03,57) [deferwq]
(root,0,0,00:00:00/1640-01:13:03,89) [kdmremove]
(root,0,0,00:00:00/1640-01:13:03,90) [kstriped]
(root,0,0,00:00:00/1640-01:12:58,233) [kdmflush]
(root,0,0,00:00:00/1640-01:12:58,235) [kdmflush]
(root,0,0,00:00:30/1640-01:12:45,252) [kjournald]
(root,10936,368,00:00:00/1640-01:12:25,341) /sbin/udevd -d
(root,0,0,00:00:00/1640-01:12:10,610) [kdmflush]
(root,0,0,00:00:00/1640-01:12:10,613) [kdmflush]
(root,0,0,00:00:00/1640-01:12:10,616) [kdmflush]
(root,0,0,00:00:00/1640-01:12:10,621) [kdmflush]
(root,0,0,00:00:00/1640-01:12:10,627) [kdmflush]
(root,10932,472,00:00:00/1640-01:12:10,628) /sbin/udevd -d
(root,0,0,00:00:00/1640-01:12:10,631) [kdmflush]
(root,10932,436,00:00:00/1640-01:12:10,632) /sbin/udevd -d
(root,0,0,00:17:56/1640-01:11:58,702) [flush-253:4]
(root,0,0,00:00:00/1640-01:11:49,706) [kjournald]
(root,0,0,00:00:00/1640-01:11:48,709) [xfs_mru_cache]
(root,0,0,00:12:34/1640-01:11:48,710) [xfslogd/0]
(root,0,0,00:00:00/1640-01:11:48,711) [xfslogd/1]
(root,0,0,00:17:28/1640-01:11:48,712) [xfsdatad/0]
(root,0,0,00:00:00/1640-01:11:48,713) [xfsdatad/1]
(root,0,0,00:00:00/1640-01:11:48,714) [xfsconvertd/0]
(root,0,0,00:00:00/1640-01:11:48,715) [xfsconvertd/1]
(root,0,0,00:00:13/1640-01:11:48,716) [xfsalloc/0]
(root,0,0,00:00:38/1640-01:11:48,717) [xfsalloc/1]
(root,0,0,00:00:13/1640-01:11:48,718) [xfseofblocks/0]
(root,0,0,00:00:48/1640-01:11:48,719) [xfseofblocks/1]
(root,0,0,00:00:00/1640-01:11:48,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1640-01:11:48,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1640-01:11:48,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1640-01:11:47,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1640-01:11:45,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1640-01:11:45,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1640-01:11:45,726) [xfssyncd/dm-2]
(root,0,0,08:45:58/1640-01:11:44,727) [xfsaild/dm-2]
(root,0,0,00:18:29/1640-01:11:17,728) [kjournald]
(root,0,0,00:08:04/1640-01:11:16,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1640-01:11:16,730) [xfs-cil/dm-5]
(root,0,0,00:07:43/1640-01:11:16,731) [xfssyncd/dm-5]
(root,0,0,11:48:57/1640-01:11:16,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1640-01:11:14,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1640-01:11:14,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1640-01:11:14,735) [xfssyncd/dm-7]
(root,0,0,08:48:41/1640-01:11:14,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1640-01:11:12,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1640-01:11:12,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1640-01:11:12,739) [xfssyncd/dm-6]
(root,0,0,08:49:01/1640-01:11:12,740) [xfsaild/dm-6]
(root,0,0,01:22:26/1640-01:10:53,816) [kauditd]
(root,93156,740,05:42:43/1640-01:10:39,1154) auditd
(root,249864,5540,03:12:14/1640-01:10:38,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:08/1640-01:10:37,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1640-01:10:36,1215) rpc.statd
(dbus,21580,1000,00:00:08/1640-01:10:34,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1640-01:10:32,1285) hald
(root,20400,836,00:00:00/1640-01:10:32,1286) hald-runner
(root,452700,1136,00:39:21/1640-01:10:26,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:19:13/1640-01:10:21,1375) /usr/sbin/sshd
(root,21716,804,00:26:45/1640-01:10:20,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:04/1640-01:10:16,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:26/1640-01:10:08,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1640-01:10:07,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:35/1640-01:09:57,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1640-01:09:55,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1640-01:09:55,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1640-01:09:55,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,162460,10-07:01:19/1640-01:09:55,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:50/1640-01:09:35,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:10/1640-01:09:35,1759) inet_gethost 4
(root,112532,776,00:00:02/1640-01:09:34,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609936,215708,01:38:49/1640-01:09:29,1776) /usr/sbin/httpd
(root,116864,704,00:14:10/1640-01:09:28,1786) crond
(root,21104,316,00:00:01/1640-01:09:28,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1640-01:09:28,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1640-01:09:28,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1640-01:09:28,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1640-01:09:28,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1640-01:09:28,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1640-01:09:28,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1640-01:09:28,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,67568,3244,00:00:00/00:05,4157) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:05,4158) sshd: [net]      
(root,110268,1488,00:00:00/00:01,4237) /bin/bash /usr/bin/check_mk_agent
(root,13368,968,00:00:00/00:01,4255) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,4256) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,611652,209692,00:00:00/2-04:01:13,8557) /usr/sbin/httpd
(apache,609936,205364,00:00:00/2-15:15:43,10242) /usr/sbin/httpd
(apache,611652,209772,00:00:00/2-15:15:43,10252) /usr/sbin/httpd
(apache,611644,209736,00:00:00/2-15:15:42,10257) /usr/sbin/httpd
(apache,611652,209728,00:00:00/2-15:15:42,10258) /usr/sbin/httpd
(apache,611652,209724,00:00:00/2-15:15:42,10267) /usr/sbin/httpd
(apache,611644,209740,00:00:00/2-15:15:42,10279) /usr/sbin/httpd
(apache,611652,209696,00:00:00/2-15:15:42,10298) /usr/sbin/httpd
(apache,611644,209760,00:00:00/2-15:15:42,10307) /usr/sbin/httpd
(apache,611652,209736,00:00:00/2-15:15:42,10318) /usr/sbin/httpd
(root,0,0,00:00:20/21-08:20:17,11877) [flush-253:5]
(apache,611652,209708,00:00:00/2-03:28:16,14479) /usr/sbin/httpd
(apache,611652,209732,00:00:00/2-03:28:11,14486) /usr/sbin/httpd
(apache,611652,209720,00:00:00/2-03:27:58,14599) /usr/sbin/httpd
(apache,611652,209692,00:00:00/2-03:27:56,14603) /usr/sbin/httpd
(apache,611652,209696,00:00:00/2-03:27:52,14611) /usr/sbin/httpd
(root,108468,1060,00:00:00/837-09:22:13,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/837-09:22:13,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/837-09:22:13,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15148,2-22:14:15/837-09:22:13,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/38:56,30083) pickup -l -t fifo -u

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-03 23:50

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939a8d20899

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:38:36/1638-00:47:32,1) /sbin/init
(root,0,0,00:00:05/1638-00:47:32,2) [kthreadd]
(root,0,0,00:15:09/1638-00:47:32,3) [migration/0]
(root,0,0,00:13:26/1638-00:47:32,4) [ksoftirqd/0]
(root,0,0,00:00:00/1638-00:47:32,5) [stopper/0]
(root,0,0,00:04:17/1638-00:47:32,6) [watchdog/0]
(root,0,0,00:22:49/1638-00:47:32,7) [migration/1]
(root,0,0,00:00:00/1638-00:47:32,8) [stopper/1]
(root,0,0,00:07:44/1638-00:47:32,9) [ksoftirqd/1]
(root,0,0,00:03:59/1638-00:47:32,10) [watchdog/1]
(root,0,0,02:55:38/1638-00:47:32,11) [events/0]
(root,0,0,03:07:21/1638-00:47:32,12) [events/1]
(root,0,0,00:00:00/1638-00:47:32,13) [cgroup]
(root,0,0,00:00:00/1638-00:47:32,14) [khelper]
(root,0,0,00:00:00/1638-00:47:32,15) [netns]
(root,0,0,00:00:00/1638-00:47:32,16) [async/mgr]
(root,0,0,00:00:00/1638-00:47:32,17) [pm]
(root,0,0,00:00:00/1638-00:47:32,18) [xenwatch]
(root,0,0,00:00:00/1638-00:47:32,19) [xenbus]
(root,0,0,00:09:22/1638-00:47:32,20) [sync_supers]
(root,0,0,00:11:07/1638-00:47:32,21) [bdi-default]
(root,0,0,00:00:00/1638-00:47:32,22) [kintegrityd/0]
(root,0,0,00:00:00/1638-00:47:32,23) [kintegrityd/1]
(root,0,0,00:09:52/1638-00:47:32,24) [kblockd/0]
(root,0,0,00:01:52/1638-00:47:32,25) [kblockd/1]
(root,0,0,00:00:00/1638-00:47:32,26) [ata_aux]
(root,0,0,00:00:00/1638-00:47:32,27) [ata_sff/0]
(root,0,0,00:00:00/1638-00:47:32,28) [ata_sff/1]
(root,0,0,00:00:00/1638-00:47:32,29) [ksuspend_usbd]
(root,0,0,00:00:00/1638-00:47:32,30) [khubd]
(root,0,0,00:00:00/1638-00:47:32,31) [kseriod]
(root,0,0,00:00:00/1638-00:47:32,32) [md/0]
(root,0,0,00:00:00/1638-00:47:32,33) [md/1]
(root,0,0,00:00:00/1638-00:47:32,34) [md_misc/0]
(root,0,0,00:00:00/1638-00:47:32,35) [md_misc/1]
(root,0,0,00:00:00/1638-00:47:32,36) [linkwatch]
(root,0,0,00:00:53/1638-00:47:32,37) [khungtaskd]
(root,0,0,00:00:08/1638-00:47:32,38) [kswapd0]
(root,0,0,00:00:00/1638-00:47:32,39) [ksmd]
(root,0,0,00:00:00/1638-00:47:32,40) [aio/0]
(root,0,0,00:00:00/1638-00:47:32,41) [aio/1]
(root,0,0,00:00:00/1638-00:47:32,42) [crypto/0]
(root,0,0,00:00:00/1638-00:47:32,43) [crypto/1]
(root,0,0,00:00:00/1638-00:47:32,51) [kthrotld/0]
(root,0,0,00:00:00/1638-00:47:32,52) [kthrotld/1]
(root,0,0,00:00:00/1638-00:47:32,54) [khvcd]
(root,0,0,00:00:00/1638-00:47:32,55) [kpsmoused]
(root,0,0,00:00:00/1638-00:47:32,56) [usbhid_resumer]
(root,0,0,00:00:00/1638-00:47:32,57) [deferwq]
(root,0,0,00:00:00/1638-00:47:32,89) [kdmremove]
(root,0,0,00:00:00/1638-00:47:32,90) [kstriped]
(root,0,0,00:00:00/1638-00:47:27,233) [kdmflush]
(root,0,0,00:00:00/1638-00:47:27,235) [kdmflush]
(root,0,0,00:00:30/1638-00:47:14,252) [kjournald]
(root,10936,368,00:00:00/1638-00:46:54,341) /sbin/udevd -d
(root,0,0,00:00:00/1638-00:46:39,610) [kdmflush]
(root,0,0,00:00:00/1638-00:46:39,613) [kdmflush]
(root,0,0,00:00:00/1638-00:46:39,616) [kdmflush]
(root,0,0,00:00:00/1638-00:46:39,621) [kdmflush]
(root,0,0,00:00:00/1638-00:46:39,627) [kdmflush]
(root,10932,472,00:00:00/1638-00:46:39,628) /sbin/udevd -d
(root,0,0,00:00:00/1638-00:46:39,631) [kdmflush]
(root,10932,436,00:00:00/1638-00:46:39,632) /sbin/udevd -d
(root,0,0,00:17:55/1638-00:46:27,702) [flush-253:4]
(root,0,0,00:00:00/1638-00:46:18,706) [kjournald]
(root,0,0,00:00:00/1638-00:46:17,709) [xfs_mru_cache]
(root,0,0,00:12:34/1638-00:46:17,710) [xfslogd/0]
(root,0,0,00:00:00/1638-00:46:17,711) [xfslogd/1]
(root,0,0,00:17:27/1638-00:46:17,712) [xfsdatad/0]
(root,0,0,00:00:00/1638-00:46:17,713) [xfsdatad/1]
(root,0,0,00:00:00/1638-00:46:17,714) [xfsconvertd/0]
(root,0,0,00:00:00/1638-00:46:17,715) [xfsconvertd/1]
(root,0,0,00:00:13/1638-00:46:17,716) [xfsalloc/0]
(root,0,0,00:00:38/1638-00:46:17,717) [xfsalloc/1]
(root,0,0,00:00:13/1638-00:46:17,718) [xfseofblocks/0]
(root,0,0,00:00:48/1638-00:46:17,719) [xfseofblocks/1]
(root,0,0,00:00:00/1638-00:46:17,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1638-00:46:17,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1638-00:46:17,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1638-00:46:16,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1638-00:46:14,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1638-00:46:14,725) [xfs-cil/dm-2]
(root,0,0,00:01:56/1638-00:46:14,726) [xfssyncd/dm-2]
(root,0,0,08:45:20/1638-00:46:13,727) [xfsaild/dm-2]
(root,0,0,00:18:28/1638-00:45:46,728) [kjournald]
(root,0,0,00:08:04/1638-00:45:45,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1638-00:45:45,730) [xfs-cil/dm-5]
(root,0,0,00:07:42/1638-00:45:45,731) [xfssyncd/dm-5]
(root,0,0,11:48:01/1638-00:45:45,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1638-00:45:43,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1638-00:45:43,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1638-00:45:43,735) [xfssyncd/dm-7]
(root,0,0,08:48:03/1638-00:45:43,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1638-00:45:41,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1638-00:45:41,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1638-00:45:41,739) [xfssyncd/dm-6]
(root,0,0,08:48:22/1638-00:45:41,740) [xfsaild/dm-6]
(root,0,0,01:22:02/1638-00:45:22,816) [kauditd]
(root,93156,740,05:41:48/1638-00:45:08,1154) auditd
(root,249864,5540,03:11:18/1638-00:45:07,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:07/1638-00:45:06,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1638-00:45:05,1215) rpc.statd
(dbus,21580,1000,00:00:08/1638-00:45:03,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1638-00:45:01,1285) hald
(root,20400,836,00:00:00/1638-00:45:01,1286) hald-runner
(root,452700,1136,00:39:18/1638-00:44:55,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:17:05/1638-00:44:50,1375) /usr/sbin/sshd
(root,21716,804,00:26:43/1638-00:44:49,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:33:01/1638-00:44:45,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:25/1638-00:44:37,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1638-00:44:36,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:33/1638-00:44:26,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1638-00:44:24,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1638-00:44:24,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1638-00:44:24,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443228,164824,10-06:42:46/1638-00:44:24,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:50/1638-00:44:04,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:10/1638-00:44:04,1759) inet_gethost 4
(root,112532,776,00:00:02/1638-00:44:03,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609936,215708,01:38:42/1638-00:43:58,1776) /usr/sbin/httpd
(root,116864,704,00:14:09/1638-00:43:57,1786) crond
(root,21104,316,00:00:01/1638-00:43:57,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1638-00:43:57,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1638-00:43:57,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1638-00:43:57,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1638-00:43:57,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1638-00:43:57,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1638-00:43:57,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1638-00:43:57,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,611652,209372,00:00:00/03:35:42,8557) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/35:49,10166) pickup -l -t fifo -u
(apache,609936,205364,00:00:00/14:50:12,10242) /usr/sbin/httpd
(apache,611652,209644,00:00:00/14:50:12,10252) /usr/sbin/httpd
(apache,611644,209672,00:00:00/14:50:11,10257) /usr/sbin/httpd
(apache,611652,209636,00:00:00/14:50:11,10258) /usr/sbin/httpd
(apache,611652,209656,00:00:00/14:50:11,10267) /usr/sbin/httpd
(apache,611644,209644,00:00:00/14:50:11,10279) /usr/sbin/httpd
(apache,611652,209624,00:00:00/14:50:11,10298) /usr/sbin/httpd
(apache,611644,209676,00:00:00/14:50:11,10307) /usr/sbin/httpd
(apache,611652,209664,00:00:00/14:50:11,10318) /usr/sbin/httpd
(root,0,0,00:00:18/19-07:54:46,11877) [flush-253:5]
(apache,611652,209416,00:00:00/03:02:45,14479) /usr/sbin/httpd
(apache,611652,209420,00:00:00/03:02:40,14486) /usr/sbin/httpd
(apache,611652,209536,00:00:00/03:02:27,14599) /usr/sbin/httpd
(apache,611652,209544,00:00:00/03:02:25,14603) /usr/sbin/httpd
(apache,611652,209404,00:00:00/03:02:21,14611) /usr/sbin/httpd
(root,98636,3796,00:00:00/00:10,16749) sshd: shutdown [priv]
(sshd,67568,1652,00:00:00/00:09,16750) sshd: shutdown [net]
(root,67568,3244,00:00:00/00:04,16755) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:03,16756) sshd: [net]      
(root,98636,3776,00:00:00/00:03,16757) sshd: postfix [priv]
(sshd,67568,1652,00:00:00/00:03,16758) sshd: postfix [net]
(root,67568,3244,00:00:00/00:03,16759) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:03,16760) sshd: [net]      
(root,98636,3800,00:00:00/00:02,16761) sshd: unknown [priv]
(sshd,67568,1736,00:00:00/00:02,16762) sshd: unknown [net]
(root,67568,3168,00:00:00/00:01,16791) sshd: [accepted] 
(root,110268,1492,00:00:00/00:01,16847) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,16865) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,16866) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/835-08:56:42,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/835-08:56:42,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/835-08:56:42,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15060,2-22:09:32/835-08:56:42,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-12-01 23:24

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793950c5a3bf

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:38:24/1636-00:47:09,1) /sbin/init
(root,0,0,00:00:05/1636-00:47:09,2) [kthreadd]
(root,0,0,00:15:08/1636-00:47:09,3) [migration/0]
(root,0,0,00:13:26/1636-00:47:09,4) [ksoftirqd/0]
(root,0,0,00:00:00/1636-00:47:09,5) [stopper/0]
(root,0,0,00:04:16/1636-00:47:09,6) [watchdog/0]
(root,0,0,00:22:46/1636-00:47:09,7) [migration/1]
(root,0,0,00:00:00/1636-00:47:09,8) [stopper/1]
(root,0,0,00:07:43/1636-00:47:09,9) [ksoftirqd/1]
(root,0,0,00:03:59/1636-00:47:09,10) [watchdog/1]
(root,0,0,02:55:26/1636-00:47:09,11) [events/0]
(root,0,0,03:07:05/1636-00:47:09,12) [events/1]
(root,0,0,00:00:00/1636-00:47:09,13) [cgroup]
(root,0,0,00:00:00/1636-00:47:09,14) [khelper]
(root,0,0,00:00:00/1636-00:47:09,15) [netns]
(root,0,0,00:00:00/1636-00:47:09,16) [async/mgr]
(root,0,0,00:00:00/1636-00:47:09,17) [pm]
(root,0,0,00:00:00/1636-00:47:09,18) [xenwatch]
(root,0,0,00:00:00/1636-00:47:09,19) [xenbus]
(root,0,0,00:09:21/1636-00:47:09,20) [sync_supers]
(root,0,0,00:11:06/1636-00:47:09,21) [bdi-default]
(root,0,0,00:00:00/1636-00:47:09,22) [kintegrityd/0]
(root,0,0,00:00:00/1636-00:47:09,23) [kintegrityd/1]
(root,0,0,00:09:52/1636-00:47:09,24) [kblockd/0]
(root,0,0,00:01:52/1636-00:47:09,25) [kblockd/1]
(root,0,0,00:00:00/1636-00:47:09,26) [ata_aux]
(root,0,0,00:00:00/1636-00:47:09,27) [ata_sff/0]
(root,0,0,00:00:00/1636-00:47:09,28) [ata_sff/1]
(root,0,0,00:00:00/1636-00:47:09,29) [ksuspend_usbd]
(root,0,0,00:00:00/1636-00:47:09,30) [khubd]
(root,0,0,00:00:00/1636-00:47:09,31) [kseriod]
(root,0,0,00:00:00/1636-00:47:09,32) [md/0]
(root,0,0,00:00:00/1636-00:47:09,33) [md/1]
(root,0,0,00:00:00/1636-00:47:09,34) [md_misc/0]
(root,0,0,00:00:00/1636-00:47:09,35) [md_misc/1]
(root,0,0,00:00:00/1636-00:47:09,36) [linkwatch]
(root,0,0,00:00:53/1636-00:47:09,37) [khungtaskd]
(root,0,0,00:00:08/1636-00:47:09,38) [kswapd0]
(root,0,0,00:00:00/1636-00:47:09,39) [ksmd]
(root,0,0,00:00:00/1636-00:47:09,40) [aio/0]
(root,0,0,00:00:00/1636-00:47:09,41) [aio/1]
(root,0,0,00:00:00/1636-00:47:09,42) [crypto/0]
(root,0,0,00:00:00/1636-00:47:09,43) [crypto/1]
(root,0,0,00:00:00/1636-00:47:09,51) [kthrotld/0]
(root,0,0,00:00:00/1636-00:47:09,52) [kthrotld/1]
(root,0,0,00:00:00/1636-00:47:09,54) [khvcd]
(root,0,0,00:00:00/1636-00:47:09,55) [kpsmoused]
(root,0,0,00:00:00/1636-00:47:09,56) [usbhid_resumer]
(root,0,0,00:00:00/1636-00:47:09,57) [deferwq]
(root,0,0,00:00:00/1636-00:47:09,89) [kdmremove]
(root,0,0,00:00:00/1636-00:47:09,90) [kstriped]
(root,0,0,00:00:00/1636-00:47:04,233) [kdmflush]
(root,0,0,00:00:00/1636-00:47:04,235) [kdmflush]
(root,0,0,00:00:30/1636-00:46:51,252) [kjournald]
(root,10936,368,00:00:00/1636-00:46:31,341) /sbin/udevd -d
(root,0,0,00:00:00/1636-00:46:16,610) [kdmflush]
(root,0,0,00:00:00/1636-00:46:16,613) [kdmflush]
(root,0,0,00:00:00/1636-00:46:16,616) [kdmflush]
(root,0,0,00:00:00/1636-00:46:16,621) [kdmflush]
(root,0,0,00:00:00/1636-00:46:16,627) [kdmflush]
(root,10932,472,00:00:00/1636-00:46:16,628) /sbin/udevd -d
(root,0,0,00:00:00/1636-00:46:16,631) [kdmflush]
(root,10932,436,00:00:00/1636-00:46:16,632) /sbin/udevd -d
(root,0,0,00:17:54/1636-00:46:04,702) [flush-253:4]
(root,0,0,00:00:00/1636-00:45:55,706) [kjournald]
(root,0,0,00:00:00/1636-00:45:54,709) [xfs_mru_cache]
(root,0,0,00:12:33/1636-00:45:54,710) [xfslogd/0]
(root,0,0,00:00:00/1636-00:45:54,711) [xfslogd/1]
(root,0,0,00:17:26/1636-00:45:54,712) [xfsdatad/0]
(root,0,0,00:00:00/1636-00:45:54,713) [xfsdatad/1]
(root,0,0,00:00:00/1636-00:45:54,714) [xfsconvertd/0]
(root,0,0,00:00:00/1636-00:45:54,715) [xfsconvertd/1]
(root,0,0,00:00:13/1636-00:45:54,716) [xfsalloc/0]
(root,0,0,00:00:38/1636-00:45:54,717) [xfsalloc/1]
(root,0,0,00:00:13/1636-00:45:54,718) [xfseofblocks/0]
(root,0,0,00:00:48/1636-00:45:54,719) [xfseofblocks/1]
(root,0,0,00:00:00/1636-00:45:54,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1636-00:45:54,721) [xfs-cil/dm-3]
(root,0,0,00:01:54/1636-00:45:54,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1636-00:45:53,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1636-00:45:51,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1636-00:45:51,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1636-00:45:51,726) [xfssyncd/dm-2]
(root,0,0,08:44:42/1636-00:45:50,727) [xfsaild/dm-2]
(root,0,0,00:18:26/1636-00:45:23,728) [kjournald]
(root,0,0,00:08:04/1636-00:45:22,729) [xfsbufd/dm-5]
(root,0,0,00:06:56/1636-00:45:22,730) [xfs-cil/dm-5]
(root,0,0,00:07:42/1636-00:45:22,731) [xfssyncd/dm-5]
(root,0,0,11:47:06/1636-00:45:22,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1636-00:45:20,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1636-00:45:20,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1636-00:45:20,735) [xfssyncd/dm-7]
(root,0,0,08:47:24/1636-00:45:20,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1636-00:45:18,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1636-00:45:18,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1636-00:45:18,739) [xfssyncd/dm-6]
(root,0,0,08:47:42/1636-00:45:18,740) [xfsaild/dm-6]
(root,0,0,01:21:36/1636-00:44:59,816) [kauditd]
(root,93156,740,05:40:49/1636-00:44:45,1154) auditd
(root,249864,5540,03:10:21/1636-00:44:44,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:07/1636-00:44:43,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1636-00:44:42,1215) rpc.statd
(dbus,21580,1000,00:00:08/1636-00:44:40,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1636-00:44:38,1285) hald
(root,20400,836,00:00:00/1636-00:44:38,1286) hald-runner
(root,452700,1136,00:39:16/1636-00:44:32,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:14:51/1636-00:44:27,1375) /usr/sbin/sshd
(root,21716,804,00:26:41/1636-00:44:26,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:32:59/1636-00:44:22,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:24/1636-00:44:14,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:46/1636-00:44:13,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:32/1636-00:44:03,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1636-00:44:01,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1636-00:44:01,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1636-00:44:01,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444852,164492,10-06:24:07/1636-00:44:01,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:50/1636-00:43:41,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:10/1636-00:43:41,1759) inet_gethost 4
(root,112532,776,00:00:02/1636-00:43:40,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609004,214864,01:38:32/1636-00:43:35,1776) /usr/sbin/httpd
(root,116864,704,00:14:08/1636-00:43:34,1786) crond
(root,21104,316,00:00:01/1636-00:43:34,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1636-00:43:34,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1636-00:43:34,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1636-00:43:34,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1636-00:43:34,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1636-00:43:34,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1636-00:43:34,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1636-00:43:34,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,610808,208908,00:00:00/2-08:30:44,2118) /usr/sbin/httpd
(apache,610808,208876,00:00:00/2-08:30:43,2121) /usr/sbin/httpd
(apache,610800,208916,00:00:00/2-08:30:42,2122) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/57:54,7654) pickup -l -t fifo -u
(root,0,0,00:00:16/17-07:54:23,11877) [flush-253:5]
(apache,610808,208932,00:00:00/3-15:15:29,16042) /usr/sbin/httpd
(apache,610800,208928,00:00:00/3-15:15:28,16046) /usr/sbin/httpd
(apache,610800,208912,00:00:00/3-15:15:28,16047) /usr/sbin/httpd
(root,67568,3168,00:00:00/01:47,18090) sshd: [accepted] 
(sshd,67568,1400,00:00:00/01:46,18091) sshd: [net]      
(root,67568,3168,00:00:00/01:05,18249) sshd: [accepted] 
(sshd,67568,1396,00:00:00/01:04,18251) sshd: [net]      
(root,67568,3164,00:00:00/00:34,18389) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:33,18393) sshd: [net]      
(root,98636,3796,00:00:00/00:09,18430) sshd: apache [priv]
(sshd,67568,1656,00:00:00/00:07,18433) sshd: apache [net]
(root,98636,3780,00:00:00/00:07,18434) sshd: rabbitmq [priv]
(sshd,67568,1652,00:00:00/00:06,18435) sshd: rabbitmq [net]
(root,67568,3164,00:00:00/00:05,18436) sshd: [accepted] 
(root,67568,3168,00:00:00/00:03,18437) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:03,18438) sshd: [net]      
(root,67568,3248,00:00:00/00:03,18439) sshd: [accepted] 
(sshd,67568,1392,00:00:00/00:02,18442) sshd: [net]      
(sshd,67568,1576,00:00:00/00:02,18443) sshd: [net]      
(root,110268,1492,00:00:00/00:01,18461) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,18479) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,804,00:00:00/00:00,18480) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/833-08:56:19,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/833-08:56:19,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/833-08:56:19,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15372,2-22:04:46/833-08:56:19,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,609004,204520,00:00:00/5-14:35:44,24564) /usr/sbin/httpd
(apache,610808,208984,00:00:00/5-14:35:44,24578) /usr/sbin/httpd
(apache,610808,208936,00:00:00/5-14:35:44,24583) /usr/sbin/httpd
(apache,610800,208996,00:00:00/5-14:35:44,24588) /usr/sbin/httpd
(apache,610800,208976,00:00:00/5-14:35:44,24589) /usr/sbin/httpd
(apache,610800,208984,00:00:00/5-14:35:44,24596) /usr/sbin/httpd
(apache,610804,208948,00:00:00/5-14:35:44,24606) /usr/sbin/httpd
(apache,610808,208932,00:00:00/5-14:35:43,24617) /usr/sbin/httpd
(apache,610808,208904,00:00:00/5-14:35:43,24629) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-29 23:24

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79391e42fede

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:38:12/1634-01:25:50,1) /sbin/init
(root,0,0,00:00:05/1634-01:25:50,2) [kthreadd]
(root,0,0,00:15:07/1634-01:25:50,3) [migration/0]
(root,0,0,00:13:24/1634-01:25:50,4) [ksoftirqd/0]
(root,0,0,00:00:00/1634-01:25:50,5) [stopper/0]
(root,0,0,00:04:16/1634-01:25:50,6) [watchdog/0]
(root,0,0,00:22:42/1634-01:25:50,7) [migration/1]
(root,0,0,00:00:00/1634-01:25:50,8) [stopper/1]
(root,0,0,00:07:42/1634-01:25:50,9) [ksoftirqd/1]
(root,0,0,00:03:59/1634-01:25:50,10) [watchdog/1]
(root,0,0,02:55:13/1634-01:25:50,11) [events/0]
(root,0,0,03:06:50/1634-01:25:50,12) [events/1]
(root,0,0,00:00:00/1634-01:25:50,13) [cgroup]
(root,0,0,00:00:00/1634-01:25:50,14) [khelper]
(root,0,0,00:00:00/1634-01:25:50,15) [netns]
(root,0,0,00:00:00/1634-01:25:50,16) [async/mgr]
(root,0,0,00:00:00/1634-01:25:50,17) [pm]
(root,0,0,00:00:00/1634-01:25:50,18) [xenwatch]
(root,0,0,00:00:00/1634-01:25:50,19) [xenbus]
(root,0,0,00:09:20/1634-01:25:50,20) [sync_supers]
(root,0,0,00:11:05/1634-01:25:50,21) [bdi-default]
(root,0,0,00:00:00/1634-01:25:50,22) [kintegrityd/0]
(root,0,0,00:00:00/1634-01:25:50,23) [kintegrityd/1]
(root,0,0,00:09:51/1634-01:25:50,24) [kblockd/0]
(root,0,0,00:01:52/1634-01:25:50,25) [kblockd/1]
(root,0,0,00:00:00/1634-01:25:50,26) [ata_aux]
(root,0,0,00:00:00/1634-01:25:50,27) [ata_sff/0]
(root,0,0,00:00:00/1634-01:25:50,28) [ata_sff/1]
(root,0,0,00:00:00/1634-01:25:50,29) [ksuspend_usbd]
(root,0,0,00:00:00/1634-01:25:50,30) [khubd]
(root,0,0,00:00:00/1634-01:25:50,31) [kseriod]
(root,0,0,00:00:00/1634-01:25:50,32) [md/0]
(root,0,0,00:00:00/1634-01:25:50,33) [md/1]
(root,0,0,00:00:00/1634-01:25:50,34) [md_misc/0]
(root,0,0,00:00:00/1634-01:25:50,35) [md_misc/1]
(root,0,0,00:00:00/1634-01:25:50,36) [linkwatch]
(root,0,0,00:00:53/1634-01:25:50,37) [khungtaskd]
(root,0,0,00:00:08/1634-01:25:50,38) [kswapd0]
(root,0,0,00:00:00/1634-01:25:50,39) [ksmd]
(root,0,0,00:00:00/1634-01:25:50,40) [aio/0]
(root,0,0,00:00:00/1634-01:25:50,41) [aio/1]
(root,0,0,00:00:00/1634-01:25:50,42) [crypto/0]
(root,0,0,00:00:00/1634-01:25:50,43) [crypto/1]
(root,0,0,00:00:00/1634-01:25:50,51) [kthrotld/0]
(root,0,0,00:00:00/1634-01:25:50,52) [kthrotld/1]
(root,0,0,00:00:00/1634-01:25:50,54) [khvcd]
(root,0,0,00:00:00/1634-01:25:50,55) [kpsmoused]
(root,0,0,00:00:00/1634-01:25:50,56) [usbhid_resumer]
(root,0,0,00:00:00/1634-01:25:50,57) [deferwq]
(root,0,0,00:00:00/1634-01:25:50,89) [kdmremove]
(root,0,0,00:00:00/1634-01:25:50,90) [kstriped]
(root,0,0,00:00:00/1634-01:25:45,233) [kdmflush]
(root,0,0,00:00:00/1634-01:25:45,235) [kdmflush]
(root,0,0,00:00:30/1634-01:25:32,252) [kjournald]
(root,10936,368,00:00:00/1634-01:25:12,341) /sbin/udevd -d
(root,0,0,00:00:00/1634-01:24:57,610) [kdmflush]
(root,0,0,00:00:00/1634-01:24:57,613) [kdmflush]
(root,0,0,00:00:00/1634-01:24:57,616) [kdmflush]
(root,0,0,00:00:00/1634-01:24:57,621) [kdmflush]
(root,0,0,00:00:00/1634-01:24:57,627) [kdmflush]
(root,10932,472,00:00:00/1634-01:24:57,628) /sbin/udevd -d
(root,0,0,00:00:00/1634-01:24:57,631) [kdmflush]
(root,10932,436,00:00:00/1634-01:24:57,632) /sbin/udevd -d
(root,0,0,00:17:53/1634-01:24:45,702) [flush-253:4]
(root,0,0,00:00:00/1634-01:24:36,706) [kjournald]
(root,0,0,00:00:00/1634-01:24:35,709) [xfs_mru_cache]
(root,0,0,00:12:31/1634-01:24:35,710) [xfslogd/0]
(root,0,0,00:00:00/1634-01:24:35,711) [xfslogd/1]
(root,0,0,00:17:22/1634-01:24:35,712) [xfsdatad/0]
(root,0,0,00:00:00/1634-01:24:35,713) [xfsdatad/1]
(root,0,0,00:00:00/1634-01:24:35,714) [xfsconvertd/0]
(root,0,0,00:00:00/1634-01:24:35,715) [xfsconvertd/1]
(root,0,0,00:00:13/1634-01:24:35,716) [xfsalloc/0]
(root,0,0,00:00:38/1634-01:24:35,717) [xfsalloc/1]
(root,0,0,00:00:13/1634-01:24:35,718) [xfseofblocks/0]
(root,0,0,00:00:48/1634-01:24:35,719) [xfseofblocks/1]
(root,0,0,00:00:00/1634-01:24:35,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1634-01:24:35,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1634-01:24:35,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1634-01:24:34,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1634-01:24:32,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1634-01:24:32,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1634-01:24:32,726) [xfssyncd/dm-2]
(root,0,0,08:44:03/1634-01:24:31,727) [xfsaild/dm-2]
(root,0,0,00:18:25/1634-01:24:04,728) [kjournald]
(root,0,0,00:08:03/1634-01:24:03,729) [xfsbufd/dm-5]
(root,0,0,00:06:54/1634-01:24:03,730) [xfs-cil/dm-5]
(root,0,0,00:07:41/1634-01:24:03,731) [xfssyncd/dm-5]
(root,0,0,11:46:12/1634-01:24:03,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1634-01:24:01,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1634-01:24:01,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1634-01:24:01,735) [xfssyncd/dm-7]
(root,0,0,08:46:44/1634-01:24:01,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1634-01:23:59,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1634-01:23:59,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1634-01:23:59,739) [xfssyncd/dm-6]
(root,0,0,08:47:03/1634-01:23:59,740) [xfsaild/dm-6]
(root,0,0,01:21:12/1634-01:23:40,816) [kauditd]
(root,93156,740,05:39:10/1634-01:23:26,1154) auditd
(root,249864,5540,03:09:23/1634-01:23:25,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:07/1634-01:23:24,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1634-01:23:23,1215) rpc.statd
(dbus,21580,1000,00:00:08/1634-01:23:21,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1634-01:23:19,1285) hald
(root,20400,836,00:00:00/1634-01:23:19,1286) hald-runner
(root,452700,1136,00:39:13/1634-01:23:13,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:12:36/1634-01:23:08,1375) /usr/sbin/sshd
(root,21716,804,00:26:40/1634-01:23:07,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:32:56/1634-01:23:03,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:24/1634-01:22:55,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1634-01:22:54,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:30/1634-01:22:44,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1634-01:22:42,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1634-01:22:42,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1634-01:22:42,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444852,168908,10-06:06:10/1634-01:22:42,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:50/1634-01:22:22,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:09/1634-01:22:22,1759) inet_gethost 4
(root,112532,776,00:00:02/1634-01:22:21,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609004,214864,01:38:24/1634-01:22:16,1776) /usr/sbin/httpd
(root,116864,704,00:14:07/1634-01:22:15,1786) crond
(root,21104,316,00:00:01/1634-01:22:15,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1634-01:22:15,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1634-01:22:15,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1634-01:22:15,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1634-01:22:15,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1634-01:22:15,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1634-01:22:15,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1634-01:22:15,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,610808,208736,00:00:00/09:09:25,2118) /usr/sbin/httpd
(apache,610808,208728,00:00:00/09:09:24,2121) /usr/sbin/httpd
(apache,610800,208740,00:00:00/09:09:23,2122) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/18:56,10447) pickup -l -t fifo -u
(root,0,0,00:00:14/15-08:33:04,11877) [flush-253:5]
(root,66224,3100,00:00:00/01:55,13765) sshd: [accepted] 
(root,0,0,00:00:00/01:44,13796) [flush-253:1]
(root,66224,3104,00:00:00/01:27,13822) sshd: [accepted] 
(root,66224,3104,00:00:00/01:15,13844) sshd: [accepted] 
(root,66224,3104,00:00:00/00:45,13984) sshd: [accepted] 
(root,66224,3100,00:00:00/00:20,14018) sshd: [accepted] 
(root,98636,3780,00:00:00/00:11,14034) sshd: adm [priv] 
(sshd,67568,1656,00:00:00/00:11,14035) sshd: adm [net]  
(root,98636,3776,00:00:00/00:08,14133) sshd: zabbix [priv]
(sshd,67568,1652,00:00:00/00:08,14134) sshd: zabbix [net]
(root,101288,4276,00:00:00/00:04,14139) sshd: root [priv]
(sshd,67568,1644,00:00:00/00:04,14140) sshd: root [net] 
(root,67568,3164,00:00:00/00:03,14141) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:01,14215) sshd: [net]      
(root,110268,1492,00:00:00/00:01,14216) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,14234) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,14235) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,610808,208812,00:00:00/1-15:54:10,16042) /usr/sbin/httpd
(apache,610800,208856,00:00:00/1-15:54:09,16046) /usr/sbin/httpd
(apache,610800,208868,00:00:00/1-15:54:09,16047) /usr/sbin/httpd
(root,108468,1060,00:00:00/831-09:35:00,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/831-09:35:00,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/831-09:35:00,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15324,2-21:53:33/831-09:35:00,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,609004,204520,00:00:00/3-15:14:25,24564) /usr/sbin/httpd
(apache,610808,208940,00:00:00/3-15:14:25,24578) /usr/sbin/httpd
(apache,610808,208912,00:00:00/3-15:14:25,24583) /usr/sbin/httpd
(apache,610800,208964,00:00:00/3-15:14:25,24588) /usr/sbin/httpd
(apache,610800,208920,00:00:00/3-15:14:25,24589) /usr/sbin/httpd
(apache,610800,208960,00:00:00/3-15:14:25,24596) /usr/sbin/httpd
(apache,610804,208928,00:00:00/3-15:14:25,24606) /usr/sbin/httpd
(apache,610808,208896,00:00:00/3-15:14:24,24617) /usr/sbin/httpd
(apache,610808,208884,00:00:00/3-15:14:24,24629) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-28 00:02

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79392be347c7

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:58/1632-01:33:10,1) /sbin/init
(root,0,0,00:00:05/1632-01:33:10,2) [kthreadd]
(root,0,0,00:15:05/1632-01:33:10,3) [migration/0]
(root,0,0,00:13:23/1632-01:33:10,4) [ksoftirqd/0]
(root,0,0,00:00:00/1632-01:33:10,5) [stopper/0]
(root,0,0,00:04:16/1632-01:33:10,6) [watchdog/0]
(root,0,0,00:22:39/1632-01:33:10,7) [migration/1]
(root,0,0,00:00:00/1632-01:33:10,8) [stopper/1]
(root,0,0,00:07:41/1632-01:33:10,9) [ksoftirqd/1]
(root,0,0,00:03:58/1632-01:33:10,10) [watchdog/1]
(root,0,0,02:55:00/1632-01:33:10,11) [events/0]
(root,0,0,03:06:35/1632-01:33:10,12) [events/1]
(root,0,0,00:00:00/1632-01:33:10,13) [cgroup]
(root,0,0,00:00:00/1632-01:33:10,14) [khelper]
(root,0,0,00:00:00/1632-01:33:10,15) [netns]
(root,0,0,00:00:00/1632-01:33:10,16) [async/mgr]
(root,0,0,00:00:00/1632-01:33:10,17) [pm]
(root,0,0,00:00:00/1632-01:33:10,18) [xenwatch]
(root,0,0,00:00:00/1632-01:33:10,19) [xenbus]
(root,0,0,00:09:19/1632-01:33:10,20) [sync_supers]
(root,0,0,00:11:04/1632-01:33:10,21) [bdi-default]
(root,0,0,00:00:00/1632-01:33:10,22) [kintegrityd/0]
(root,0,0,00:00:00/1632-01:33:10,23) [kintegrityd/1]
(root,0,0,00:09:49/1632-01:33:10,24) [kblockd/0]
(root,0,0,00:01:51/1632-01:33:10,25) [kblockd/1]
(root,0,0,00:00:00/1632-01:33:10,26) [ata_aux]
(root,0,0,00:00:00/1632-01:33:10,27) [ata_sff/0]
(root,0,0,00:00:00/1632-01:33:10,28) [ata_sff/1]
(root,0,0,00:00:00/1632-01:33:10,29) [ksuspend_usbd]
(root,0,0,00:00:00/1632-01:33:10,30) [khubd]
(root,0,0,00:00:00/1632-01:33:10,31) [kseriod]
(root,0,0,00:00:00/1632-01:33:10,32) [md/0]
(root,0,0,00:00:00/1632-01:33:10,33) [md/1]
(root,0,0,00:00:00/1632-01:33:10,34) [md_misc/0]
(root,0,0,00:00:00/1632-01:33:10,35) [md_misc/1]
(root,0,0,00:00:00/1632-01:33:10,36) [linkwatch]
(root,0,0,00:00:53/1632-01:33:10,37) [khungtaskd]
(root,0,0,00:00:07/1632-01:33:10,38) [kswapd0]
(root,0,0,00:00:00/1632-01:33:10,39) [ksmd]
(root,0,0,00:00:00/1632-01:33:10,40) [aio/0]
(root,0,0,00:00:00/1632-01:33:10,41) [aio/1]
(root,0,0,00:00:00/1632-01:33:10,42) [crypto/0]
(root,0,0,00:00:00/1632-01:33:10,43) [crypto/1]
(root,0,0,00:00:00/1632-01:33:10,51) [kthrotld/0]
(root,0,0,00:00:00/1632-01:33:10,52) [kthrotld/1]
(root,0,0,00:00:00/1632-01:33:10,54) [khvcd]
(root,0,0,00:00:00/1632-01:33:10,55) [kpsmoused]
(root,0,0,00:00:00/1632-01:33:10,56) [usbhid_resumer]
(root,0,0,00:00:00/1632-01:33:10,57) [deferwq]
(root,0,0,00:00:00/1632-01:33:10,89) [kdmremove]
(root,0,0,00:00:00/1632-01:33:10,90) [kstriped]
(root,0,0,00:00:00/1632-01:33:05,233) [kdmflush]
(root,0,0,00:00:00/1632-01:33:05,235) [kdmflush]
(root,0,0,00:00:30/1632-01:32:52,252) [kjournald]
(root,10936,368,00:00:00/1632-01:32:32,341) /sbin/udevd -d
(root,0,0,00:00:00/1632-01:32:17,610) [kdmflush]
(root,0,0,00:00:00/1632-01:32:17,613) [kdmflush]
(root,0,0,00:00:00/1632-01:32:17,616) [kdmflush]
(root,0,0,00:00:00/1632-01:32:17,621) [kdmflush]
(root,0,0,00:00:00/1632-01:32:17,627) [kdmflush]
(root,10932,472,00:00:00/1632-01:32:17,628) /sbin/udevd -d
(root,0,0,00:00:00/1632-01:32:17,631) [kdmflush]
(root,10932,436,00:00:00/1632-01:32:17,632) /sbin/udevd -d
(root,0,0,00:17:51/1632-01:32:05,702) [flush-253:4]
(root,0,0,00:00:00/1632-01:31:56,706) [kjournald]
(root,0,0,00:00:00/1632-01:31:55,709) [xfs_mru_cache]
(root,0,0,00:12:28/1632-01:31:55,710) [xfslogd/0]
(root,0,0,00:00:00/1632-01:31:55,711) [xfslogd/1]
(root,0,0,00:17:18/1632-01:31:55,712) [xfsdatad/0]
(root,0,0,00:00:00/1632-01:31:55,713) [xfsdatad/1]
(root,0,0,00:00:00/1632-01:31:55,714) [xfsconvertd/0]
(root,0,0,00:00:00/1632-01:31:55,715) [xfsconvertd/1]
(root,0,0,00:00:13/1632-01:31:55,716) [xfsalloc/0]
(root,0,0,00:00:38/1632-01:31:55,717) [xfsalloc/1]
(root,0,0,00:00:13/1632-01:31:55,718) [xfseofblocks/0]
(root,0,0,00:00:48/1632-01:31:55,719) [xfseofblocks/1]
(root,0,0,00:00:00/1632-01:31:55,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1632-01:31:55,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1632-01:31:55,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1632-01:31:54,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1632-01:31:52,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1632-01:31:52,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1632-01:31:52,726) [xfssyncd/dm-2]
(root,0,0,08:43:22/1632-01:31:51,727) [xfsaild/dm-2]
(root,0,0,00:18:24/1632-01:31:24,728) [kjournald]
(root,0,0,00:08:03/1632-01:31:23,729) [xfsbufd/dm-5]
(root,0,0,00:06:52/1632-01:31:23,730) [xfs-cil/dm-5]
(root,0,0,00:07:41/1632-01:31:23,731) [xfssyncd/dm-5]
(root,0,0,11:45:18/1632-01:31:23,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1632-01:31:21,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1632-01:31:21,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1632-01:31:21,735) [xfssyncd/dm-7]
(root,0,0,08:46:02/1632-01:31:21,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1632-01:31:19,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1632-01:31:19,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1632-01:31:19,739) [xfssyncd/dm-6]
(root,0,0,08:46:22/1632-01:31:19,740) [xfsaild/dm-6]
(root,0,0,01:20:45/1632-01:31:00,816) [kauditd]
(root,93156,740,05:37:24/1632-01:30:46,1154) auditd
(root,249864,5540,03:08:22/1632-01:30:45,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:07/1632-01:30:44,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1632-01:30:43,1215) rpc.statd
(dbus,21580,1000,00:00:08/1632-01:30:41,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1632-01:30:39,1285) hald
(root,20400,836,00:00:00/1632-01:30:39,1286) hald-runner
(root,452700,1136,00:39:10/1632-01:30:33,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:10:09/1632-01:30:28,1375) /usr/sbin/sshd
(root,21716,804,00:26:38/1632-01:30:27,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:32:54/1632-01:30:23,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:23/1632-01:30:15,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1632-01:30:14,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:28/1632-01:30:04,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1632-01:30:02,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1632-01:30:02,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1632-01:30:02,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443364,170424,10-05:48:01/1632-01:30:02,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:50/1632-01:29:42,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:09/1632-01:29:42,1759) inet_gethost 4
(root,112532,776,00:00:02/1632-01:29:41,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,609004,214864,01:38:16/1632-01:29:36,1776) /usr/sbin/httpd
(root,116864,704,00:14:06/1632-01:29:35,1786) crond
(root,21104,316,00:00:01/1632-01:29:35,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1632-01:29:35,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1632-01:29:35,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1632-01:29:35,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1632-01:29:35,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1632-01:29:35,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1632-01:29:35,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1632-01:29:35,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3360,00:00:00/48:47,9666) pickup -l -t fifo -u
(root,0,0,00:00:13/13-08:40:24,11877) [flush-253:5]
(root,98636,3780,00:00:00/00:08,18735) sshd: ntp [priv] 
(sshd,67568,1652,00:00:00/00:08,18736) sshd: ntp [net]  
(root,67568,3248,00:00:00/00:08,18737) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:07,18742) sshd: [net]      
(root,67568,3244,00:00:00/00:05,18743) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:04,18744) sshd: [net]      
(root,98636,3776,00:00:00/00:04,18745) sshd: apache [priv]
(sshd,67568,1656,00:00:00/00:04,18746) sshd: apache [net]
(root,67568,3248,00:00:00/00:04,18747) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:04,18748) sshd: [net]      
(root,67568,3168,00:00:00/00:03,18749) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:01,18853) sshd: [net]      
(root,110268,1488,00:00:00/00:01,18854) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,18872) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,18873) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/829-09:42:20,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/829-09:42:20,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/829-09:42:20,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15212,2-21:42:02/829-09:42:20,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,609004,204520,00:00:00/1-15:21:45,24564) /usr/sbin/httpd
(apache,610808,208844,00:00:00/1-15:21:45,24578) /usr/sbin/httpd
(apache,610808,208856,00:00:00/1-15:21:45,24583) /usr/sbin/httpd
(apache,610800,208848,00:00:00/1-15:21:45,24588) /usr/sbin/httpd
(apache,610800,208856,00:00:00/1-15:21:45,24589) /usr/sbin/httpd
(apache,610800,208896,00:00:00/1-15:21:45,24596) /usr/sbin/httpd
(apache,610804,208880,00:00:00/1-15:21:45,24606) /usr/sbin/httpd
(apache,610808,208836,00:00:00/1-15:21:44,24617) /usr/sbin/httpd
(apache,610808,208832,00:00:00/1-15:21:44,24629) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-26 00:10

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939ac9b60d8

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:45/1630-00:51:45,1) /sbin/init
(root,0,0,00:00:05/1630-00:51:45,2) [kthreadd]
(root,0,0,00:15:04/1630-00:51:45,3) [migration/0]
(root,0,0,00:13:21/1630-00:51:45,4) [ksoftirqd/0]
(root,0,0,00:00:00/1630-00:51:45,5) [stopper/0]
(root,0,0,00:04:15/1630-00:51:45,6) [watchdog/0]
(root,0,0,00:22:35/1630-00:51:45,7) [migration/1]
(root,0,0,00:00:00/1630-00:51:45,8) [stopper/1]
(root,0,0,00:07:40/1630-00:51:45,9) [ksoftirqd/1]
(root,0,0,00:03:58/1630-00:51:45,10) [watchdog/1]
(root,0,0,02:54:47/1630-00:51:45,11) [events/0]
(root,0,0,03:06:20/1630-00:51:45,12) [events/1]
(root,0,0,00:00:00/1630-00:51:45,13) [cgroup]
(root,0,0,00:00:00/1630-00:51:45,14) [khelper]
(root,0,0,00:00:00/1630-00:51:45,15) [netns]
(root,0,0,00:00:00/1630-00:51:45,16) [async/mgr]
(root,0,0,00:00:00/1630-00:51:45,17) [pm]
(root,0,0,00:00:00/1630-00:51:45,18) [xenwatch]
(root,0,0,00:00:00/1630-00:51:45,19) [xenbus]
(root,0,0,00:09:19/1630-00:51:45,20) [sync_supers]
(root,0,0,00:11:03/1630-00:51:45,21) [bdi-default]
(root,0,0,00:00:00/1630-00:51:45,22) [kintegrityd/0]
(root,0,0,00:00:00/1630-00:51:45,23) [kintegrityd/1]
(root,0,0,00:09:48/1630-00:51:45,24) [kblockd/0]
(root,0,0,00:01:51/1630-00:51:45,25) [kblockd/1]
(root,0,0,00:00:00/1630-00:51:45,26) [ata_aux]
(root,0,0,00:00:00/1630-00:51:45,27) [ata_sff/0]
(root,0,0,00:00:00/1630-00:51:45,28) [ata_sff/1]
(root,0,0,00:00:00/1630-00:51:45,29) [ksuspend_usbd]
(root,0,0,00:00:00/1630-00:51:45,30) [khubd]
(root,0,0,00:00:00/1630-00:51:45,31) [kseriod]
(root,0,0,00:00:00/1630-00:51:45,32) [md/0]
(root,0,0,00:00:00/1630-00:51:45,33) [md/1]
(root,0,0,00:00:00/1630-00:51:45,34) [md_misc/0]
(root,0,0,00:00:00/1630-00:51:45,35) [md_misc/1]
(root,0,0,00:00:00/1630-00:51:45,36) [linkwatch]
(root,0,0,00:00:53/1630-00:51:45,37) [khungtaskd]
(root,0,0,00:00:07/1630-00:51:45,38) [kswapd0]
(root,0,0,00:00:00/1630-00:51:45,39) [ksmd]
(root,0,0,00:00:00/1630-00:51:45,40) [aio/0]
(root,0,0,00:00:00/1630-00:51:45,41) [aio/1]
(root,0,0,00:00:00/1630-00:51:45,42) [crypto/0]
(root,0,0,00:00:00/1630-00:51:45,43) [crypto/1]
(root,0,0,00:00:00/1630-00:51:45,51) [kthrotld/0]
(root,0,0,00:00:00/1630-00:51:45,52) [kthrotld/1]
(root,0,0,00:00:00/1630-00:51:45,54) [khvcd]
(root,0,0,00:00:00/1630-00:51:45,55) [kpsmoused]
(root,0,0,00:00:00/1630-00:51:45,56) [usbhid_resumer]
(root,0,0,00:00:00/1630-00:51:45,57) [deferwq]
(root,0,0,00:00:00/1630-00:51:45,89) [kdmremove]
(root,0,0,00:00:00/1630-00:51:45,90) [kstriped]
(root,0,0,00:00:00/1630-00:51:40,233) [kdmflush]
(root,0,0,00:00:00/1630-00:51:40,235) [kdmflush]
(root,0,0,00:00:30/1630-00:51:27,252) [kjournald]
(root,10936,368,00:00:00/1630-00:51:07,341) /sbin/udevd -d
(root,0,0,00:00:00/1630-00:50:52,610) [kdmflush]
(root,0,0,00:00:00/1630-00:50:52,613) [kdmflush]
(root,0,0,00:00:00/1630-00:50:52,616) [kdmflush]
(root,0,0,00:00:00/1630-00:50:52,621) [kdmflush]
(root,0,0,00:00:00/1630-00:50:52,627) [kdmflush]
(root,10932,472,00:00:00/1630-00:50:52,628) /sbin/udevd -d
(root,0,0,00:00:00/1630-00:50:52,631) [kdmflush]
(root,10932,436,00:00:00/1630-00:50:52,632) /sbin/udevd -d
(root,0,0,00:17:50/1630-00:50:40,702) [flush-253:4]
(root,0,0,00:00:00/1630-00:50:31,706) [kjournald]
(root,0,0,00:00:00/1630-00:50:30,709) [xfs_mru_cache]
(root,0,0,00:12:25/1630-00:50:30,710) [xfslogd/0]
(root,0,0,00:00:00/1630-00:50:30,711) [xfslogd/1]
(root,0,0,00:17:14/1630-00:50:30,712) [xfsdatad/0]
(root,0,0,00:00:00/1630-00:50:30,713) [xfsdatad/1]
(root,0,0,00:00:00/1630-00:50:30,714) [xfsconvertd/0]
(root,0,0,00:00:00/1630-00:50:30,715) [xfsconvertd/1]
(root,0,0,00:00:13/1630-00:50:30,716) [xfsalloc/0]
(root,0,0,00:00:38/1630-00:50:30,717) [xfsalloc/1]
(root,0,0,00:00:13/1630-00:50:30,718) [xfseofblocks/0]
(root,0,0,00:00:48/1630-00:50:30,719) [xfseofblocks/1]
(root,0,0,00:00:00/1630-00:50:30,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1630-00:50:30,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1630-00:50:30,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1630-00:50:29,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1630-00:50:27,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1630-00:50:27,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1630-00:50:27,726) [xfssyncd/dm-2]
(root,0,0,08:42:42/1630-00:50:26,727) [xfsaild/dm-2]
(root,0,0,00:18:22/1630-00:49:59,728) [kjournald]
(root,0,0,00:08:02/1630-00:49:58,729) [xfsbufd/dm-5]
(root,0,0,00:06:51/1630-00:49:58,730) [xfs-cil/dm-5]
(root,0,0,00:07:40/1630-00:49:58,731) [xfssyncd/dm-5]
(root,0,0,11:44:21/1630-00:49:58,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1630-00:49:56,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1630-00:49:56,734) [xfs-cil/dm-7]
(root,0,0,00:01:54/1630-00:49:56,735) [xfssyncd/dm-7]
(root,0,0,08:45:22/1630-00:49:56,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1630-00:49:54,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1630-00:49:54,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1630-00:49:54,739) [xfssyncd/dm-6]
(root,0,0,08:45:41/1630-00:49:54,740) [xfsaild/dm-6]
(root,0,0,01:20:17/1630-00:49:35,816) [kauditd]
(root,93156,740,05:35:33/1630-00:49:21,1154) auditd
(root,249864,5540,03:07:19/1630-00:49:20,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:06/1630-00:49:19,1195) rpcbind
(rpcuser,23404,1088,00:00:00/1630-00:49:18,1215) rpc.statd
(dbus,21580,1000,00:00:08/1630-00:49:16,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1630-00:49:14,1285) hald
(root,20400,836,00:00:00/1630-00:49:14,1286) hald-runner
(root,452700,1136,00:39:07/1630-00:49:08,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:07:38/1630-00:49:03,1375) /usr/sbin/sshd
(root,21716,804,00:26:36/1630-00:49:02,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:32:51/1630-00:48:58,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:22/1630-00:48:50,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1630-00:48:49,1555) qmgr -l -t fifo -u
(rabbitmq,10952,628,00:26:26/1630-00:48:39,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1630-00:48:37,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1630-00:48:37,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1630-00:48:37,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443876,176732,10-05:29:36/1630-00:48:37,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:49/1630-00:48:17,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:09/1630-00:48:17,1759) inet_gethost 4
(root,112532,776,00:00:02/1630-00:48:16,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,608212,214016,01:38:08/1630-00:48:11,1776) /usr/sbin/httpd
(root,116864,704,00:14:05/1630-00:48:10,1786) crond
(root,21104,316,00:00:01/1630-00:48:10,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1630-00:48:10,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1630-00:48:10,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1630-00:48:10,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1630-00:48:10,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1630-00:48:10,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1630-00:48:10,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1630-00:48:10,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3364,00:00:00/29:56,4402) pickup -l -t fifo -u
(root,67568,3168,00:00:00/00:13,10320) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:12,10325) sshd: [net]      
(root,98636,3776,00:00:00/00:06,10332) sshd: adm [priv] 
(sshd,67568,1652,00:00:00/00:06,10333) sshd: adm [net]  
(root,98636,3784,00:00:00/00:05,10335) sshd: rpcuser [priv]
(root,98636,3796,00:00:00/00:05,10336) sshd: unknown [priv]
(sshd,67568,1736,00:00:00/00:05,10337) sshd: unknown [net]
(sshd,67568,1656,00:00:00/00:05,10339) sshd: rpcuser [net]
(root,66224,3104,00:00:00/00:04,10340) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,10442) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,10460) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,10461) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:11/11-07:58:59,11877) [flush-253:5]
(apache,609960,207988,00:00:00/1-21:52:42,15119) /usr/sbin/httpd
(apache,609960,208104,00:00:00/6-09:15:53,16346) /usr/sbin/httpd
(apache,609960,208028,00:00:00/4-08:56:58,20766) /usr/sbin/httpd
(apache,609960,208088,00:00:00/4-08:56:49,20776) /usr/sbin/httpd
(root,108468,1060,00:00:00/827-09:00:55,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/827-09:00:55,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/827-09:00:55,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15580,2-21:30:20/827-09:00:55,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608212,203672,00:00:00/6-14:57:14,21804) /usr/sbin/httpd
(apache,609952,208096,00:00:00/6-14:57:14,21817) /usr/sbin/httpd
(apache,609952,208384,00:00:00/6-14:57:14,21827) /usr/sbin/httpd
(apache,609952,208380,00:00:00/6-14:57:14,21828) /usr/sbin/httpd
(apache,609952,208380,00:00:00/6-14:57:14,21829) /usr/sbin/httpd
(apache,609952,208132,00:00:00/6-14:57:14,21830) /usr/sbin/httpd
(apache,609952,208124,00:00:00/6-14:57:14,21845) /usr/sbin/httpd
(apache,609952,208424,00:00:00/6-14:57:14,21847) /usr/sbin/httpd
(apache,609960,208080,00:00:00/6-14:57:13,21848) /usr/sbin/httpd
(apache,609952,208072,00:00:00/6-14:19:52,28494) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-23 23:28

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79398a93107f

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:33/1628-01:01:57,1) /sbin/init
(root,0,0,00:00:05/1628-01:01:57,2) [kthreadd]
(root,0,0,00:15:03/1628-01:01:57,3) [migration/0]
(root,0,0,00:13:19/1628-01:01:57,4) [ksoftirqd/0]
(root,0,0,00:00:00/1628-01:01:57,5) [stopper/0]
(root,0,0,00:04:15/1628-01:01:57,6) [watchdog/0]
(root,0,0,00:22:32/1628-01:01:57,7) [migration/1]
(root,0,0,00:00:00/1628-01:01:57,8) [stopper/1]
(root,0,0,00:07:39/1628-01:01:57,9) [ksoftirqd/1]
(root,0,0,00:03:58/1628-01:01:57,10) [watchdog/1]
(root,0,0,02:54:35/1628-01:01:57,11) [events/0]
(root,0,0,03:06:05/1628-01:01:57,12) [events/1]
(root,0,0,00:00:00/1628-01:01:57,13) [cgroup]
(root,0,0,00:00:00/1628-01:01:57,14) [khelper]
(root,0,0,00:00:00/1628-01:01:57,15) [netns]
(root,0,0,00:00:00/1628-01:01:57,16) [async/mgr]
(root,0,0,00:00:00/1628-01:01:57,17) [pm]
(root,0,0,00:00:00/1628-01:01:57,18) [xenwatch]
(root,0,0,00:00:00/1628-01:01:57,19) [xenbus]
(root,0,0,00:09:18/1628-01:01:57,20) [sync_supers]
(root,0,0,00:11:03/1628-01:01:57,21) [bdi-default]
(root,0,0,00:00:00/1628-01:01:57,22) [kintegrityd/0]
(root,0,0,00:00:00/1628-01:01:57,23) [kintegrityd/1]
(root,0,0,00:09:47/1628-01:01:57,24) [kblockd/0]
(root,0,0,00:01:51/1628-01:01:57,25) [kblockd/1]
(root,0,0,00:00:00/1628-01:01:57,26) [ata_aux]
(root,0,0,00:00:00/1628-01:01:57,27) [ata_sff/0]
(root,0,0,00:00:00/1628-01:01:57,28) [ata_sff/1]
(root,0,0,00:00:00/1628-01:01:57,29) [ksuspend_usbd]
(root,0,0,00:00:00/1628-01:01:57,30) [khubd]
(root,0,0,00:00:00/1628-01:01:57,31) [kseriod]
(root,0,0,00:00:00/1628-01:01:57,32) [md/0]
(root,0,0,00:00:00/1628-01:01:57,33) [md/1]
(root,0,0,00:00:00/1628-01:01:57,34) [md_misc/0]
(root,0,0,00:00:00/1628-01:01:57,35) [md_misc/1]
(root,0,0,00:00:00/1628-01:01:57,36) [linkwatch]
(root,0,0,00:00:53/1628-01:01:57,37) [khungtaskd]
(root,0,0,00:00:07/1628-01:01:57,38) [kswapd0]
(root,0,0,00:00:00/1628-01:01:57,39) [ksmd]
(root,0,0,00:00:00/1628-01:01:57,40) [aio/0]
(root,0,0,00:00:00/1628-01:01:57,41) [aio/1]
(root,0,0,00:00:00/1628-01:01:57,42) [crypto/0]
(root,0,0,00:00:00/1628-01:01:57,43) [crypto/1]
(root,0,0,00:00:00/1628-01:01:57,51) [kthrotld/0]
(root,0,0,00:00:00/1628-01:01:57,52) [kthrotld/1]
(root,0,0,00:00:00/1628-01:01:57,54) [khvcd]
(root,0,0,00:00:00/1628-01:01:57,55) [kpsmoused]
(root,0,0,00:00:00/1628-01:01:57,56) [usbhid_resumer]
(root,0,0,00:00:00/1628-01:01:57,57) [deferwq]
(root,0,0,00:00:00/1628-01:01:57,89) [kdmremove]
(root,0,0,00:00:00/1628-01:01:57,90) [kstriped]
(root,0,0,00:00:00/1628-01:01:52,233) [kdmflush]
(root,0,0,00:00:00/1628-01:01:52,235) [kdmflush]
(root,0,0,00:00:30/1628-01:01:39,252) [kjournald]
(root,10936,368,00:00:00/1628-01:01:19,341) /sbin/udevd -d
(root,0,0,00:00:00/1628-01:01:04,610) [kdmflush]
(root,0,0,00:00:00/1628-01:01:04,613) [kdmflush]
(root,0,0,00:00:00/1628-01:01:04,616) [kdmflush]
(root,0,0,00:00:00/1628-01:01:04,621) [kdmflush]
(root,0,0,00:00:00/1628-01:01:04,627) [kdmflush]
(root,10932,472,00:00:00/1628-01:01:04,628) /sbin/udevd -d
(root,0,0,00:00:00/1628-01:01:04,631) [kdmflush]
(root,10932,436,00:00:00/1628-01:01:04,632) /sbin/udevd -d
(root,0,0,00:17:48/1628-01:00:52,702) [flush-253:4]
(root,0,0,00:00:00/1628-01:00:43,706) [kjournald]
(root,0,0,00:00:00/1628-01:00:42,709) [xfs_mru_cache]
(root,0,0,00:12:23/1628-01:00:42,710) [xfslogd/0]
(root,0,0,00:00:00/1628-01:00:42,711) [xfslogd/1]
(root,0,0,00:17:10/1628-01:00:42,712) [xfsdatad/0]
(root,0,0,00:00:00/1628-01:00:42,713) [xfsdatad/1]
(root,0,0,00:00:00/1628-01:00:42,714) [xfsconvertd/0]
(root,0,0,00:00:00/1628-01:00:42,715) [xfsconvertd/1]
(root,0,0,00:00:13/1628-01:00:42,716) [xfsalloc/0]
(root,0,0,00:00:38/1628-01:00:42,717) [xfsalloc/1]
(root,0,0,00:00:13/1628-01:00:42,718) [xfseofblocks/0]
(root,0,0,00:00:47/1628-01:00:42,719) [xfseofblocks/1]
(root,0,0,00:00:00/1628-01:00:42,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1628-01:00:42,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1628-01:00:42,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1628-01:00:41,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1628-01:00:39,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1628-01:00:39,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1628-01:00:39,726) [xfssyncd/dm-2]
(root,0,0,08:42:00/1628-01:00:38,727) [xfsaild/dm-2]
(root,0,0,00:18:21/1628-01:00:11,728) [kjournald]
(root,0,0,00:08:02/1628-01:00:10,729) [xfsbufd/dm-5]
(root,0,0,00:06:49/1628-01:00:10,730) [xfs-cil/dm-5]
(root,0,0,00:07:40/1628-01:00:10,731) [xfssyncd/dm-5]
(root,0,0,11:43:28/1628-01:00:10,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1628-01:00:08,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1628-01:00:08,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1628-01:00:08,735) [xfssyncd/dm-7]
(root,0,0,08:44:39/1628-01:00:08,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1628-01:00:06,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1628-01:00:06,738) [xfs-cil/dm-6]
(root,0,0,00:01:57/1628-01:00:06,739) [xfssyncd/dm-6]
(root,0,0,08:44:59/1628-01:00:06,740) [xfsaild/dm-6]
(root,0,0,01:19:55/1628-00:59:47,816) [kauditd]
(root,93156,740,05:34:03/1628-00:59:33,1154) auditd
(root,249864,5540,03:06:27/1628-00:59:32,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:06/1628-00:59:31,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1628-00:59:30,1215) rpc.statd
(dbus,21580,1000,00:00:08/1628-00:59:28,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1628-00:59:26,1285) hald
(root,20400,836,00:00:00/1628-00:59:26,1286) hald-runner
(root,452700,1136,00:39:05/1628-00:59:20,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:05:37/1628-00:59:15,1375) /usr/sbin/sshd
(root,21716,804,00:26:34/1628-00:59:14,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:49/1628-00:59:10,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:21/1628-00:59:02,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1628-00:59:01,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:24/1628-00:58:51,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1628-00:58:49,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1628-00:58:49,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1628-00:58:49,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443364,179516,10-05:11:08/1628-00:58:49,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:49/1628-00:58:29,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:08/1628-00:58:29,1759) inet_gethost 4
(root,112532,776,00:00:02/1628-00:58:28,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,608212,214016,01:38:00/1628-00:58:23,1776) /usr/sbin/httpd
(root,116864,704,00:14:04/1628-00:58:22,1786) crond
(root,21104,316,00:00:01/1628-00:58:22,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1628-00:58:22,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1628-00:58:22,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1628-00:58:22,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1628-00:58:22,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1628-00:58:22,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1628-00:58:22,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1628-00:58:22,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:09/9-08:09:11,11877) [flush-253:5]
(apache,609960,208072,00:00:00/4-09:26:05,16346) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/01:02:36,17689) pickup -l -t fifo -u
(apache,609960,207992,00:00:00/2-09:07:10,20766) /usr/sbin/httpd
(apache,609960,208060,00:00:00/2-09:07:01,20776) /usr/sbin/httpd
(root,108468,1060,00:00:00/825-09:11:07,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/825-09:11:07,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/825-09:11:07,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14956,2-21:18:49/825-09:11:07,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608212,203672,00:00:00/4-15:07:26,21804) /usr/sbin/httpd
(apache,609952,208088,00:00:00/4-15:07:26,21817) /usr/sbin/httpd
(apache,609952,208072,00:00:00/4-15:07:26,21827) /usr/sbin/httpd
(apache,609952,208068,00:00:00/4-15:07:26,21828) /usr/sbin/httpd
(apache,609952,208080,00:00:00/4-15:07:26,21829) /usr/sbin/httpd
(apache,609952,208096,00:00:00/4-15:07:26,21830) /usr/sbin/httpd
(apache,609952,208116,00:00:00/4-15:07:26,21845) /usr/sbin/httpd
(apache,609952,208076,00:00:00/4-15:07:26,21847) /usr/sbin/httpd
(apache,609960,208052,00:00:00/4-15:07:25,21848) /usr/sbin/httpd
(root,101428,4384,00:00:00/00:15,27957) sshd: root [priv]
(sshd,67568,1640,00:00:00/00:15,27958) sshd: root [net] 
(root,101428,4396,00:00:00/00:15,27959) sshd: root [priv]
(sshd,67568,1652,00:00:00/00:13,27962) sshd: root [net] 
(root,101292,4276,00:00:00/00:06,27977) sshd: root [priv]
(sshd,67568,1640,00:00:00/00:06,27978) sshd: root [net] 
(root,67568,3244,00:00:00/00:04,27981) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:04,27984) sshd: [net]      
(root,110268,1488,00:00:00/00:01,28049) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,28067) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,28068) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,609952,208064,00:00:00/4-14:30:04,28494) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-21 23:38

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939e41b5869

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:26/1626-01:34:01,1) /sbin/init
(root,0,0,00:00:05/1626-01:34:01,2) [kthreadd]
(root,0,0,00:15:02/1626-01:34:01,3) [migration/0]
(root,0,0,00:13:18/1626-01:34:01,4) [ksoftirqd/0]
(root,0,0,00:00:00/1626-01:34:01,5) [stopper/0]
(root,0,0,00:04:15/1626-01:34:01,6) [watchdog/0]
(root,0,0,00:22:30/1626-01:34:01,7) [migration/1]
(root,0,0,00:00:00/1626-01:34:01,8) [stopper/1]
(root,0,0,00:07:39/1626-01:34:01,9) [ksoftirqd/1]
(root,0,0,00:03:57/1626-01:34:01,10) [watchdog/1]
(root,0,0,02:54:22/1626-01:34:01,11) [events/0]
(root,0,0,03:05:50/1626-01:34:01,12) [events/1]
(root,0,0,00:00:00/1626-01:34:01,13) [cgroup]
(root,0,0,00:00:00/1626-01:34:01,14) [khelper]
(root,0,0,00:00:00/1626-01:34:01,15) [netns]
(root,0,0,00:00:00/1626-01:34:01,16) [async/mgr]
(root,0,0,00:00:00/1626-01:34:01,17) [pm]
(root,0,0,00:00:00/1626-01:34:01,18) [xenwatch]
(root,0,0,00:00:00/1626-01:34:01,19) [xenbus]
(root,0,0,00:09:17/1626-01:34:01,20) [sync_supers]
(root,0,0,00:11:02/1626-01:34:01,21) [bdi-default]
(root,0,0,00:00:00/1626-01:34:01,22) [kintegrityd/0]
(root,0,0,00:00:00/1626-01:34:01,23) [kintegrityd/1]
(root,0,0,00:09:46/1626-01:34:01,24) [kblockd/0]
(root,0,0,00:01:51/1626-01:34:01,25) [kblockd/1]
(root,0,0,00:00:00/1626-01:34:01,26) [ata_aux]
(root,0,0,00:00:00/1626-01:34:01,27) [ata_sff/0]
(root,0,0,00:00:00/1626-01:34:01,28) [ata_sff/1]
(root,0,0,00:00:00/1626-01:34:01,29) [ksuspend_usbd]
(root,0,0,00:00:00/1626-01:34:01,30) [khubd]
(root,0,0,00:00:00/1626-01:34:01,31) [kseriod]
(root,0,0,00:00:00/1626-01:34:01,32) [md/0]
(root,0,0,00:00:00/1626-01:34:01,33) [md/1]
(root,0,0,00:00:00/1626-01:34:01,34) [md_misc/0]
(root,0,0,00:00:00/1626-01:34:01,35) [md_misc/1]
(root,0,0,00:00:00/1626-01:34:01,36) [linkwatch]
(root,0,0,00:00:53/1626-01:34:01,37) [khungtaskd]
(root,0,0,00:00:07/1626-01:34:01,38) [kswapd0]
(root,0,0,00:00:00/1626-01:34:01,39) [ksmd]
(root,0,0,00:00:00/1626-01:34:01,40) [aio/0]
(root,0,0,00:00:00/1626-01:34:01,41) [aio/1]
(root,0,0,00:00:00/1626-01:34:01,42) [crypto/0]
(root,0,0,00:00:00/1626-01:34:01,43) [crypto/1]
(root,0,0,00:00:00/1626-01:34:01,51) [kthrotld/0]
(root,0,0,00:00:00/1626-01:34:01,52) [kthrotld/1]
(root,0,0,00:00:00/1626-01:34:01,54) [khvcd]
(root,0,0,00:00:00/1626-01:34:01,55) [kpsmoused]
(root,0,0,00:00:00/1626-01:34:01,56) [usbhid_resumer]
(root,0,0,00:00:00/1626-01:34:01,57) [deferwq]
(root,0,0,00:00:00/1626-01:34:01,89) [kdmremove]
(root,0,0,00:00:00/1626-01:34:01,90) [kstriped]
(root,0,0,00:00:00/1626-01:33:56,233) [kdmflush]
(root,0,0,00:00:00/1626-01:33:56,235) [kdmflush]
(root,0,0,00:00:30/1626-01:33:43,252) [kjournald]
(root,10936,368,00:00:00/1626-01:33:23,341) /sbin/udevd -d
(root,0,0,00:00:00/1626-01:33:08,610) [kdmflush]
(root,0,0,00:00:00/1626-01:33:08,613) [kdmflush]
(root,0,0,00:00:00/1626-01:33:08,616) [kdmflush]
(root,0,0,00:00:00/1626-01:33:08,621) [kdmflush]
(root,0,0,00:00:00/1626-01:33:08,627) [kdmflush]
(root,10932,472,00:00:00/1626-01:33:08,628) /sbin/udevd -d
(root,0,0,00:00:00/1626-01:33:08,631) [kdmflush]
(root,10932,436,00:00:00/1626-01:33:08,632) /sbin/udevd -d
(root,0,0,00:17:47/1626-01:32:56,702) [flush-253:4]
(root,0,0,00:00:00/1626-01:32:47,706) [kjournald]
(root,0,0,00:00:00/1626-01:32:46,709) [xfs_mru_cache]
(root,0,0,00:12:21/1626-01:32:46,710) [xfslogd/0]
(root,0,0,00:00:00/1626-01:32:46,711) [xfslogd/1]
(root,0,0,00:17:08/1626-01:32:46,712) [xfsdatad/0]
(root,0,0,00:00:00/1626-01:32:46,713) [xfsdatad/1]
(root,0,0,00:00:00/1626-01:32:46,714) [xfsconvertd/0]
(root,0,0,00:00:00/1626-01:32:46,715) [xfsconvertd/1]
(root,0,0,00:00:13/1626-01:32:46,716) [xfsalloc/0]
(root,0,0,00:00:38/1626-01:32:46,717) [xfsalloc/1]
(root,0,0,00:00:13/1626-01:32:46,718) [xfseofblocks/0]
(root,0,0,00:00:47/1626-01:32:46,719) [xfseofblocks/1]
(root,0,0,00:00:00/1626-01:32:46,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1626-01:32:46,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1626-01:32:46,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1626-01:32:45,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1626-01:32:43,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1626-01:32:43,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1626-01:32:43,726) [xfssyncd/dm-2]
(root,0,0,08:41:20/1626-01:32:42,727) [xfsaild/dm-2]
(root,0,0,00:18:19/1626-01:32:15,728) [kjournald]
(root,0,0,00:08:01/1626-01:32:14,729) [xfsbufd/dm-5]
(root,0,0,00:06:48/1626-01:32:14,730) [xfs-cil/dm-5]
(root,0,0,00:07:39/1626-01:32:14,731) [xfssyncd/dm-5]
(root,0,0,11:42:34/1626-01:32:14,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1626-01:32:12,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1626-01:32:12,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1626-01:32:12,735) [xfssyncd/dm-7]
(root,0,0,08:43:59/1626-01:32:12,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1626-01:32:10,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1626-01:32:10,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1626-01:32:10,739) [xfssyncd/dm-6]
(root,0,0,08:44:19/1626-01:32:10,740) [xfsaild/dm-6]
(root,0,0,01:19:39/1626-01:31:51,816) [kauditd]
(root,93156,740,05:32:58/1626-01:31:37,1154) auditd
(root,249864,5540,03:05:47/1626-01:31:36,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:06/1626-01:31:35,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1626-01:31:34,1215) rpc.statd
(dbus,21580,1000,00:00:08/1626-01:31:32,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1626-01:31:30,1285) hald
(root,20400,836,00:00:00/1626-01:31:30,1286) hald-runner
(root,452700,1136,00:39:02/1626-01:31:24,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:04:14/1626-01:31:19,1375) /usr/sbin/sshd
(root,21716,804,00:26:32/1626-01:31:18,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:47/1626-01:31:14,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:20/1626-01:31:06,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1626-01:31:05,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:22/1626-01:30:55,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1626-01:30:53,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1626-01:30:53,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1626-01:30:53,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443364,179516,10-04:53:00/1626-01:30:53,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:49/1626-01:30:33,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:08/1626-01:30:33,1759) inet_gethost 4
(root,112532,776,00:00:02/1626-01:30:32,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,608212,214016,01:37:53/1626-01:30:27,1776) /usr/sbin/httpd
(root,116864,704,00:14:03/1626-01:30:26,1786) crond
(root,21104,316,00:00:01/1626-01:30:26,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1626-01:30:26,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1626-01:30:26,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1626-01:30:26,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1626-01:30:26,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1626-01:30:26,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1626-01:30:26,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1626-01:30:26,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:07/7-08:41:15,11877) [flush-253:5]
(postfix,80944,3364,00:00:00/17:04,15810) pickup -l -t fifo -u
(apache,609960,208032,00:00:00/2-09:58:09,16346) /usr/sbin/httpd
(root,67568,3164,00:00:00/01:54,18224) sshd: [accepted] 
(sshd,67568,1396,00:00:00/01:52,18225) sshd: [net]      
(root,98636,3780,00:00:00/00:09,18532) sshd: webalizer [priv]
(sshd,67568,1656,00:00:00/00:08,18534) sshd: webalizer [net]
(root,101292,4280,00:00:00/00:03,18542) sshd: root [priv]
(sshd,67568,1644,00:00:00/00:03,18543) sshd: root [net] 
(root,66224,3100,00:00:00/00:01,18544) sshd: [accepted] 
(root,110268,1492,00:00:00/00:01,18580) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,18598) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,18599) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,609960,207768,00:00:00/09:39:14,20766) /usr/sbin/httpd
(apache,609960,207860,00:00:00/09:39:05,20776) /usr/sbin/httpd
(root,108468,1060,00:00:00/823-09:43:11,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/823-09:43:11,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/823-09:43:11,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14844,2-21:07:31/823-09:43:11,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608212,203672,00:00:00/2-15:39:30,21804) /usr/sbin/httpd
(apache,609952,208056,00:00:00/2-15:39:30,21817) /usr/sbin/httpd
(apache,609952,208040,00:00:00/2-15:39:30,21827) /usr/sbin/httpd
(apache,609952,208028,00:00:00/2-15:39:30,21828) /usr/sbin/httpd
(apache,609952,208048,00:00:00/2-15:39:30,21829) /usr/sbin/httpd
(apache,609952,208076,00:00:00/2-15:39:30,21830) /usr/sbin/httpd
(apache,609952,208016,00:00:00/2-15:39:30,21845) /usr/sbin/httpd
(apache,609952,208056,00:00:00/2-15:39:30,21847) /usr/sbin/httpd
(apache,609960,208004,00:00:00/2-15:39:29,21848) /usr/sbin/httpd
(apache,609952,208004,00:00:00/2-15:02:08,28494) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-20 00:10

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939530c464c

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:16/1624-01:08:17,1) /sbin/init
(root,0,0,00:00:05/1624-01:08:17,2) [kthreadd]
(root,0,0,00:15:01/1624-01:08:17,3) [migration/0]
(root,0,0,00:13:16/1624-01:08:17,4) [ksoftirqd/0]
(root,0,0,00:00:00/1624-01:08:17,5) [stopper/0]
(root,0,0,00:04:14/1624-01:08:17,6) [watchdog/0]
(root,0,0,00:22:27/1624-01:08:17,7) [migration/1]
(root,0,0,00:00:00/1624-01:08:17,8) [stopper/1]
(root,0,0,00:07:38/1624-01:08:17,9) [ksoftirqd/1]
(root,0,0,00:03:57/1624-01:08:17,10) [watchdog/1]
(root,0,0,02:54:09/1624-01:08:17,11) [events/0]
(root,0,0,03:05:35/1624-01:08:17,12) [events/1]
(root,0,0,00:00:00/1624-01:08:17,13) [cgroup]
(root,0,0,00:00:00/1624-01:08:17,14) [khelper]
(root,0,0,00:00:00/1624-01:08:17,15) [netns]
(root,0,0,00:00:00/1624-01:08:17,16) [async/mgr]
(root,0,0,00:00:00/1624-01:08:17,17) [pm]
(root,0,0,00:00:00/1624-01:08:17,18) [xenwatch]
(root,0,0,00:00:00/1624-01:08:17,19) [xenbus]
(root,0,0,00:09:17/1624-01:08:17,20) [sync_supers]
(root,0,0,00:11:01/1624-01:08:17,21) [bdi-default]
(root,0,0,00:00:00/1624-01:08:17,22) [kintegrityd/0]
(root,0,0,00:00:00/1624-01:08:17,23) [kintegrityd/1]
(root,0,0,00:09:45/1624-01:08:17,24) [kblockd/0]
(root,0,0,00:01:51/1624-01:08:17,25) [kblockd/1]
(root,0,0,00:00:00/1624-01:08:17,26) [ata_aux]
(root,0,0,00:00:00/1624-01:08:17,27) [ata_sff/0]
(root,0,0,00:00:00/1624-01:08:17,28) [ata_sff/1]
(root,0,0,00:00:00/1624-01:08:17,29) [ksuspend_usbd]
(root,0,0,00:00:00/1624-01:08:17,30) [khubd]
(root,0,0,00:00:00/1624-01:08:17,31) [kseriod]
(root,0,0,00:00:00/1624-01:08:17,32) [md/0]
(root,0,0,00:00:00/1624-01:08:17,33) [md/1]
(root,0,0,00:00:00/1624-01:08:17,34) [md_misc/0]
(root,0,0,00:00:00/1624-01:08:17,35) [md_misc/1]
(root,0,0,00:00:00/1624-01:08:17,36) [linkwatch]
(root,0,0,00:00:53/1624-01:08:17,37) [khungtaskd]
(root,0,0,00:00:07/1624-01:08:17,38) [kswapd0]
(root,0,0,00:00:00/1624-01:08:17,39) [ksmd]
(root,0,0,00:00:00/1624-01:08:17,40) [aio/0]
(root,0,0,00:00:00/1624-01:08:17,41) [aio/1]
(root,0,0,00:00:00/1624-01:08:17,42) [crypto/0]
(root,0,0,00:00:00/1624-01:08:17,43) [crypto/1]
(root,0,0,00:00:00/1624-01:08:17,51) [kthrotld/0]
(root,0,0,00:00:00/1624-01:08:17,52) [kthrotld/1]
(root,0,0,00:00:00/1624-01:08:17,54) [khvcd]
(root,0,0,00:00:00/1624-01:08:17,55) [kpsmoused]
(root,0,0,00:00:00/1624-01:08:17,56) [usbhid_resumer]
(root,0,0,00:00:00/1624-01:08:17,57) [deferwq]
(root,0,0,00:00:00/1624-01:08:17,89) [kdmremove]
(root,0,0,00:00:00/1624-01:08:17,90) [kstriped]
(root,0,0,00:00:00/1624-01:08:12,233) [kdmflush]
(root,0,0,00:00:00/1624-01:08:12,235) [kdmflush]
(root,0,0,00:00:30/1624-01:07:59,252) [kjournald]
(root,10936,368,00:00:00/1624-01:07:39,341) /sbin/udevd -d
(root,0,0,00:00:00/1624-01:07:24,610) [kdmflush]
(root,0,0,00:00:00/1624-01:07:24,613) [kdmflush]
(root,0,0,00:00:00/1624-01:07:24,616) [kdmflush]
(root,0,0,00:00:00/1624-01:07:24,621) [kdmflush]
(root,0,0,00:00:00/1624-01:07:24,627) [kdmflush]
(root,10932,472,00:00:00/1624-01:07:24,628) /sbin/udevd -d
(root,0,0,00:00:00/1624-01:07:24,631) [kdmflush]
(root,10932,436,00:00:00/1624-01:07:24,632) /sbin/udevd -d
(root,0,0,00:17:46/1624-01:07:12,702) [flush-253:4]
(root,0,0,00:00:00/1624-01:07:03,706) [kjournald]
(root,0,0,00:00:00/1624-01:07:02,709) [xfs_mru_cache]
(root,0,0,00:12:19/1624-01:07:02,710) [xfslogd/0]
(root,0,0,00:00:00/1624-01:07:02,711) [xfslogd/1]
(root,0,0,00:17:04/1624-01:07:02,712) [xfsdatad/0]
(root,0,0,00:00:00/1624-01:07:02,713) [xfsdatad/1]
(root,0,0,00:00:00/1624-01:07:02,714) [xfsconvertd/0]
(root,0,0,00:00:00/1624-01:07:02,715) [xfsconvertd/1]
(root,0,0,00:00:13/1624-01:07:02,716) [xfsalloc/0]
(root,0,0,00:00:38/1624-01:07:02,717) [xfsalloc/1]
(root,0,0,00:00:13/1624-01:07:02,718) [xfseofblocks/0]
(root,0,0,00:00:47/1624-01:07:02,719) [xfseofblocks/1]
(root,0,0,00:00:00/1624-01:07:02,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1624-01:07:02,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1624-01:07:02,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1624-01:07:01,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1624-01:06:59,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1624-01:06:59,725) [xfs-cil/dm-2]
(root,0,0,00:01:55/1624-01:06:59,726) [xfssyncd/dm-2]
(root,0,0,08:40:39/1624-01:06:58,727) [xfsaild/dm-2]
(root,0,0,00:18:18/1624-01:06:31,728) [kjournald]
(root,0,0,00:08:01/1624-01:06:30,729) [xfsbufd/dm-5]
(root,0,0,00:06:47/1624-01:06:30,730) [xfs-cil/dm-5]
(root,0,0,00:07:39/1624-01:06:30,731) [xfssyncd/dm-5]
(root,0,0,11:41:38/1624-01:06:30,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1624-01:06:28,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1624-01:06:28,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1624-01:06:28,735) [xfssyncd/dm-7]
(root,0,0,08:43:18/1624-01:06:28,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1624-01:06:26,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1624-01:06:26,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1624-01:06:26,739) [xfssyncd/dm-6]
(root,0,0,08:43:38/1624-01:06:26,740) [xfsaild/dm-6]
(root,0,0,01:19:19/1624-01:06:07,816) [kauditd]
(root,93156,740,05:31:33/1624-01:05:53,1154) auditd
(root,249864,5540,03:04:58/1624-01:05:52,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:05/1624-01:05:51,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1624-01:05:50,1215) rpc.statd
(dbus,21580,1000,00:00:08/1624-01:05:48,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1624-01:05:46,1285) hald
(root,20400,836,00:00:00/1624-01:05:46,1286) hald-runner
(root,452700,1136,00:38:59/1624-01:05:40,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:02:23/1624-01:05:35,1375) /usr/sbin/sshd
(root,21716,804,00:26:30/1624-01:05:34,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:44/1624-01:05:30,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:19/1624-01:05:22,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1624-01:05:21,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:20/1624-01:05:11,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1624-01:05:09,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1624-01:05:09,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1624-01:05:09,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,179236,10-04:34:38/1624-01:05:09,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:49/1624-01:04:49,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:08/1624-01:04:49,1759) inet_gethost 4
(root,112532,776,00:00:02/1624-01:04:48,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,608212,214016,01:37:46/1624-01:04:43,1776) /usr/sbin/httpd
(root,116864,704,00:14:02/1624-01:04:42,1786) crond
(root,21104,316,00:00:01/1624-01:04:42,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1624-01:04:42,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1624-01:04:42,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1624-01:04:42,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1624-01:04:42,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1624-01:04:42,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1624-01:04:42,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1624-01:04:42,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:05/5-08:15:31,11877) [flush-253:5]
(postfix,80944,3364,00:00:00/13:47,15923) pickup -l -t fifo -u
(apache,609960,207860,00:00:00/09:32:25,16346) /usr/sbin/httpd
(root,66224,3104,00:00:00/01:33,18024) sshd: [accepted] 
(root,67568,3248,00:00:00/00:07,18226) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:07,18227) sshd: [net]      
(root,67568,3260,00:00:00/00:03,18230) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:03,18231) sshd: [net]      
(root,67568,3168,00:00:00/00:02,18232) sshd: [accepted] 
(root,67568,3168,00:00:00/00:02,18233) sshd: [accepted] 
(sshd,67568,1404,00:00:00/00:02,18234) sshd: [net]      
(sshd,67568,1400,00:00:00/00:01,18235) sshd: [net]      
(root,110268,1492,00:00:00/00:01,18253) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,18271) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,18272) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/821-09:17:27,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/821-09:17:27,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/821-09:17:27,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15780,2-20:55:56/821-09:17:27,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608212,203672,00:00:00/15:13:46,21804) /usr/sbin/httpd
(apache,609952,207948,00:00:00/15:13:46,21817) /usr/sbin/httpd
(apache,609952,207860,00:00:00/15:13:46,21827) /usr/sbin/httpd
(apache,609952,207896,00:00:00/15:13:46,21828) /usr/sbin/httpd
(apache,609952,207888,00:00:00/15:13:46,21829) /usr/sbin/httpd
(apache,609952,207904,00:00:00/15:13:46,21830) /usr/sbin/httpd
(apache,609952,207884,00:00:00/15:13:46,21845) /usr/sbin/httpd
(apache,609952,207940,00:00:00/15:13:46,21847) /usr/sbin/httpd
(apache,609960,207916,00:00:00/15:13:45,21848) /usr/sbin/httpd
(apache,609952,207880,00:00:00/14:36:24,28494) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-17 23:45

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939b3d3a37f

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:37:06/1622-01:40:22,1) /sbin/init
(root,0,0,00:00:05/1622-01:40:22,2) [kthreadd]
(root,0,0,00:15:00/1622-01:40:22,3) [migration/0]
(root,0,0,00:13:15/1622-01:40:22,4) [ksoftirqd/0]
(root,0,0,00:00:00/1622-01:40:22,5) [stopper/0]
(root,0,0,00:04:14/1622-01:40:22,6) [watchdog/0]
(root,0,0,00:22:24/1622-01:40:22,7) [migration/1]
(root,0,0,00:00:00/1622-01:40:22,8) [stopper/1]
(root,0,0,00:07:37/1622-01:40:22,9) [ksoftirqd/1]
(root,0,0,00:03:57/1622-01:40:22,10) [watchdog/1]
(root,0,0,02:53:56/1622-01:40:22,11) [events/0]
(root,0,0,03:05:20/1622-01:40:22,12) [events/1]
(root,0,0,00:00:00/1622-01:40:22,13) [cgroup]
(root,0,0,00:00:00/1622-01:40:22,14) [khelper]
(root,0,0,00:00:00/1622-01:40:22,15) [netns]
(root,0,0,00:00:00/1622-01:40:22,16) [async/mgr]
(root,0,0,00:00:00/1622-01:40:22,17) [pm]
(root,0,0,00:00:00/1622-01:40:22,18) [xenwatch]
(root,0,0,00:00:00/1622-01:40:22,19) [xenbus]
(root,0,0,00:09:16/1622-01:40:22,20) [sync_supers]
(root,0,0,00:11:00/1622-01:40:22,21) [bdi-default]
(root,0,0,00:00:00/1622-01:40:22,22) [kintegrityd/0]
(root,0,0,00:00:00/1622-01:40:22,23) [kintegrityd/1]
(root,0,0,00:09:44/1622-01:40:22,24) [kblockd/0]
(root,0,0,00:01:51/1622-01:40:22,25) [kblockd/1]
(root,0,0,00:00:00/1622-01:40:22,26) [ata_aux]
(root,0,0,00:00:00/1622-01:40:22,27) [ata_sff/0]
(root,0,0,00:00:00/1622-01:40:22,28) [ata_sff/1]
(root,0,0,00:00:00/1622-01:40:22,29) [ksuspend_usbd]
(root,0,0,00:00:00/1622-01:40:22,30) [khubd]
(root,0,0,00:00:00/1622-01:40:22,31) [kseriod]
(root,0,0,00:00:00/1622-01:40:22,32) [md/0]
(root,0,0,00:00:00/1622-01:40:22,33) [md/1]
(root,0,0,00:00:00/1622-01:40:22,34) [md_misc/0]
(root,0,0,00:00:00/1622-01:40:22,35) [md_misc/1]
(root,0,0,00:00:00/1622-01:40:22,36) [linkwatch]
(root,0,0,00:00:53/1622-01:40:22,37) [khungtaskd]
(root,0,0,00:00:07/1622-01:40:22,38) [kswapd0]
(root,0,0,00:00:00/1622-01:40:22,39) [ksmd]
(root,0,0,00:00:00/1622-01:40:22,40) [aio/0]
(root,0,0,00:00:00/1622-01:40:22,41) [aio/1]
(root,0,0,00:00:00/1622-01:40:22,42) [crypto/0]
(root,0,0,00:00:00/1622-01:40:22,43) [crypto/1]
(root,0,0,00:00:00/1622-01:40:22,51) [kthrotld/0]
(root,0,0,00:00:00/1622-01:40:22,52) [kthrotld/1]
(root,0,0,00:00:00/1622-01:40:22,54) [khvcd]
(root,0,0,00:00:00/1622-01:40:22,55) [kpsmoused]
(root,0,0,00:00:00/1622-01:40:22,56) [usbhid_resumer]
(root,0,0,00:00:00/1622-01:40:22,57) [deferwq]
(root,0,0,00:00:00/1622-01:40:22,89) [kdmremove]
(root,0,0,00:00:00/1622-01:40:22,90) [kstriped]
(root,0,0,00:00:00/1622-01:40:17,233) [kdmflush]
(root,0,0,00:00:00/1622-01:40:17,235) [kdmflush]
(root,0,0,00:00:30/1622-01:40:04,252) [kjournald]
(root,10936,368,00:00:00/1622-01:39:44,341) /sbin/udevd -d
(root,0,0,00:00:00/1622-01:39:29,610) [kdmflush]
(root,0,0,00:00:00/1622-01:39:29,613) [kdmflush]
(root,0,0,00:00:00/1622-01:39:29,616) [kdmflush]
(root,0,0,00:00:00/1622-01:39:29,621) [kdmflush]
(root,0,0,00:00:00/1622-01:39:29,627) [kdmflush]
(root,10932,472,00:00:00/1622-01:39:29,628) /sbin/udevd -d
(root,0,0,00:00:00/1622-01:39:29,631) [kdmflush]
(root,10932,436,00:00:00/1622-01:39:29,632) /sbin/udevd -d
(root,0,0,00:17:45/1622-01:39:17,702) [flush-253:4]
(root,0,0,00:00:00/1622-01:39:08,706) [kjournald]
(root,0,0,00:00:00/1622-01:39:07,709) [xfs_mru_cache]
(root,0,0,00:12:17/1622-01:39:07,710) [xfslogd/0]
(root,0,0,00:00:00/1622-01:39:07,711) [xfslogd/1]
(root,0,0,00:17:01/1622-01:39:07,712) [xfsdatad/0]
(root,0,0,00:00:00/1622-01:39:07,713) [xfsdatad/1]
(root,0,0,00:00:00/1622-01:39:07,714) [xfsconvertd/0]
(root,0,0,00:00:00/1622-01:39:07,715) [xfsconvertd/1]
(root,0,0,00:00:13/1622-01:39:07,716) [xfsalloc/0]
(root,0,0,00:00:37/1622-01:39:07,717) [xfsalloc/1]
(root,0,0,00:00:13/1622-01:39:07,718) [xfseofblocks/0]
(root,0,0,00:00:47/1622-01:39:07,719) [xfseofblocks/1]
(root,0,0,00:00:00/1622-01:39:07,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1622-01:39:07,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1622-01:39:07,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1622-01:39:06,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1622-01:39:04,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1622-01:39:04,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1622-01:39:04,726) [xfssyncd/dm-2]
(root,0,0,08:39:58/1622-01:39:03,727) [xfsaild/dm-2]
(root,0,0,00:18:17/1622-01:38:36,728) [kjournald]
(root,0,0,00:08:00/1622-01:38:35,729) [xfsbufd/dm-5]
(root,0,0,00:06:45/1622-01:38:35,730) [xfs-cil/dm-5]
(root,0,0,00:07:38/1622-01:38:35,731) [xfssyncd/dm-5]
(root,0,0,11:40:44/1622-01:38:35,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1622-01:38:33,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1622-01:38:33,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1622-01:38:33,735) [xfssyncd/dm-7]
(root,0,0,08:42:37/1622-01:38:33,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1622-01:38:31,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1622-01:38:31,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1622-01:38:31,739) [xfssyncd/dm-6]
(root,0,0,08:42:57/1622-01:38:31,740) [xfsaild/dm-6]
(root,0,0,01:18:59/1622-01:38:12,816) [kauditd]
(root,93156,740,05:30:14/1622-01:37:58,1154) auditd
(root,249864,5540,03:04:13/1622-01:37:57,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:05/1622-01:37:56,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1622-01:37:55,1215) rpc.statd
(dbus,21580,1000,00:00:08/1622-01:37:53,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1622-01:37:51,1285) hald
(root,20400,836,00:00:00/1622-01:37:51,1286) hald-runner
(root,452700,1136,00:38:56/1622-01:37:45,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,07:00:37/1622-01:37:40,1375) /usr/sbin/sshd
(root,21716,804,00:26:28/1622-01:37:39,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:42/1622-01:37:35,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:19/1622-01:37:27,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1622-01:37:26,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:18/1622-01:37:16,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1622-01:37:14,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1622-01:37:14,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1622-01:37:14,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1442068,179508,10-04:16:30/1622-01:37:14,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:49/1622-01:36:54,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:07/1622-01:36:54,1759) inet_gethost 4
(root,112532,776,00:00:02/1622-01:36:53,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,607420,213172,01:37:36/1622-01:36:48,1776) /usr/sbin/httpd
(root,116864,704,00:14:01/1622-01:36:47,1786) crond
(root,21104,316,00:00:01/1622-01:36:47,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1622-01:36:47,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1622-01:36:47,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1622-01:36:47,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1622-01:36:47,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1622-01:36:47,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1622-01:36:47,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1622-01:36:47,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,101292,4272,00:00:00/00:07,2560) sshd: root [priv]
(root,98636,3808,00:00:00/00:06,2561) sshd: apache [priv]
(sshd,67568,1660,00:00:00/00:06,2562) sshd: apache [net]
(sshd,67568,1656,00:00:00/00:05,2563) sshd: root [net] 
(root,67568,3244,00:00:00/00:05,2564) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:05,2565) sshd: [net]      
(root,98636,3776,00:00:00/00:04,2568) sshd: nfsnobody [priv]
(sshd,67568,1648,00:00:00/00:04,2569) sshd: nfsnobody [net]
(root,67568,3164,00:00:00/00:02,2570) sshd: [accepted] 
(sshd,67568,1392,00:00:00/00:01,2631) sshd: [net]      
(root,110268,1492,00:00:00/00:01,2648) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,2666) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,2667) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:03/3-08:47:36,11877) [flush-253:5]
(apache,609116,207512,00:00:00/4-08:44:44,12141) /usr/sbin/httpd
(postfix,80944,3360,00:00:00/01:08:23,19448) pickup -l -t fifo -u
(root,108468,1060,00:00:00/819-09:49:32,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/819-09:49:32,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/819-09:49:32,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15052,2-20:44:25/819-09:49:32,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,607420,202828,00:00:00/5-15:44:53,29954) /usr/sbin/httpd
(apache,609108,207288,00:00:00/5-15:44:52,29961) /usr/sbin/httpd
(apache,609108,207304,00:00:00/5-15:44:52,29976) /usr/sbin/httpd
(apache,609116,207596,00:00:00/5-15:44:52,29987) /usr/sbin/httpd
(apache,609116,207624,00:00:00/5-15:44:52,29997) /usr/sbin/httpd
(apache,609108,207632,00:00:00/5-15:44:52,30009) /usr/sbin/httpd
(apache,609108,207312,00:00:00/5-15:44:52,30023) /usr/sbin/httpd
(apache,609116,207620,00:00:00/5-15:44:52,30034) /usr/sbin/httpd
(apache,609108,207584,00:00:00/5-15:44:52,30046) /usr/sbin/httpd
(apache,609116,207432,00:00:00/3-10:10:14,31582) /usr/sbin/httpd
(apache,609116,207444,00:00:00/3-10:10:13,31583) /usr/sbin/httpd
(apache,609116,207432,00:00:00/3-10:10:12,31584) /usr/sbin/httpd
(apache,609116,207420,00:00:00/3-10:10:11,31585) /usr/sbin/httpd
(apache,609116,207436,00:00:00/3-10:10:11,31586) /usr/sbin/httpd
(apache,609116,207428,00:00:00/3-10:10:11,31587) /usr/sbin/httpd
(apache,609116,207468,00:00:00/3-10:10:11,31588) /usr/sbin/httpd
(apache,609116,207456,00:00:00/3-10:10:06,31596) /usr/sbin/httpd
(apache,609116,207168,00:00:00/3-10:10:03,31600) /usr/sbin/httpd
(apache,609116,207480,00:00:00/3-10:09:53,31617) /usr/sbin/httpd
(apache,609116,207468,00:00:00/3-10:09:46,31629) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-16 00:17

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939ecf7ef60

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:52/1620-01:39:30,1) /sbin/init
(root,0,0,00:00:05/1620-01:39:30,2) [kthreadd]
(root,0,0,00:14:59/1620-01:39:30,3) [migration/0]
(root,0,0,00:13:13/1620-01:39:30,4) [ksoftirqd/0]
(root,0,0,00:00:00/1620-01:39:30,5) [stopper/0]
(root,0,0,00:04:14/1620-01:39:30,6) [watchdog/0]
(root,0,0,00:22:21/1620-01:39:30,7) [migration/1]
(root,0,0,00:00:00/1620-01:39:30,8) [stopper/1]
(root,0,0,00:07:36/1620-01:39:30,9) [ksoftirqd/1]
(root,0,0,00:03:57/1620-01:39:30,10) [watchdog/1]
(root,0,0,02:53:43/1620-01:39:30,11) [events/0]
(root,0,0,03:05:05/1620-01:39:30,12) [events/1]
(root,0,0,00:00:00/1620-01:39:30,13) [cgroup]
(root,0,0,00:00:00/1620-01:39:30,14) [khelper]
(root,0,0,00:00:00/1620-01:39:30,15) [netns]
(root,0,0,00:00:00/1620-01:39:30,16) [async/mgr]
(root,0,0,00:00:00/1620-01:39:30,17) [pm]
(root,0,0,00:00:00/1620-01:39:30,18) [xenwatch]
(root,0,0,00:00:00/1620-01:39:30,19) [xenbus]
(root,0,0,00:09:15/1620-01:39:30,20) [sync_supers]
(root,0,0,00:10:59/1620-01:39:30,21) [bdi-default]
(root,0,0,00:00:00/1620-01:39:30,22) [kintegrityd/0]
(root,0,0,00:00:00/1620-01:39:30,23) [kintegrityd/1]
(root,0,0,00:09:42/1620-01:39:30,24) [kblockd/0]
(root,0,0,00:01:51/1620-01:39:30,25) [kblockd/1]
(root,0,0,00:00:00/1620-01:39:30,26) [ata_aux]
(root,0,0,00:00:00/1620-01:39:30,27) [ata_sff/0]
(root,0,0,00:00:00/1620-01:39:30,28) [ata_sff/1]
(root,0,0,00:00:00/1620-01:39:30,29) [ksuspend_usbd]
(root,0,0,00:00:00/1620-01:39:30,30) [khubd]
(root,0,0,00:00:00/1620-01:39:30,31) [kseriod]
(root,0,0,00:00:00/1620-01:39:30,32) [md/0]
(root,0,0,00:00:00/1620-01:39:30,33) [md/1]
(root,0,0,00:00:00/1620-01:39:30,34) [md_misc/0]
(root,0,0,00:00:00/1620-01:39:30,35) [md_misc/1]
(root,0,0,00:00:00/1620-01:39:30,36) [linkwatch]
(root,0,0,00:00:53/1620-01:39:30,37) [khungtaskd]
(root,0,0,00:00:07/1620-01:39:30,38) [kswapd0]
(root,0,0,00:00:00/1620-01:39:30,39) [ksmd]
(root,0,0,00:00:00/1620-01:39:30,40) [aio/0]
(root,0,0,00:00:00/1620-01:39:30,41) [aio/1]
(root,0,0,00:00:00/1620-01:39:30,42) [crypto/0]
(root,0,0,00:00:00/1620-01:39:30,43) [crypto/1]
(root,0,0,00:00:00/1620-01:39:30,51) [kthrotld/0]
(root,0,0,00:00:00/1620-01:39:30,52) [kthrotld/1]
(root,0,0,00:00:00/1620-01:39:30,54) [khvcd]
(root,0,0,00:00:00/1620-01:39:30,55) [kpsmoused]
(root,0,0,00:00:00/1620-01:39:30,56) [usbhid_resumer]
(root,0,0,00:00:00/1620-01:39:30,57) [deferwq]
(root,0,0,00:00:00/1620-01:39:30,89) [kdmremove]
(root,0,0,00:00:00/1620-01:39:30,90) [kstriped]
(root,0,0,00:00:00/1620-01:39:25,233) [kdmflush]
(root,0,0,00:00:00/1620-01:39:25,235) [kdmflush]
(root,0,0,00:00:30/1620-01:39:12,252) [kjournald]
(root,10936,368,00:00:00/1620-01:38:52,341) /sbin/udevd -d
(root,0,0,00:00:00/1620-01:38:37,610) [kdmflush]
(root,0,0,00:00:00/1620-01:38:37,613) [kdmflush]
(root,0,0,00:00:00/1620-01:38:37,616) [kdmflush]
(root,0,0,00:00:00/1620-01:38:37,621) [kdmflush]
(root,0,0,00:00:00/1620-01:38:37,627) [kdmflush]
(root,10932,472,00:00:00/1620-01:38:37,628) /sbin/udevd -d
(root,0,0,00:00:00/1620-01:38:37,631) [kdmflush]
(root,10932,436,00:00:00/1620-01:38:37,632) /sbin/udevd -d
(root,0,0,00:17:43/1620-01:38:25,702) [flush-253:4]
(root,0,0,00:00:00/1620-01:38:16,706) [kjournald]
(root,0,0,00:00:00/1620-01:38:15,709) [xfs_mru_cache]
(root,0,0,00:12:14/1620-01:38:15,710) [xfslogd/0]
(root,0,0,00:00:00/1620-01:38:15,711) [xfslogd/1]
(root,0,0,00:16:57/1620-01:38:15,712) [xfsdatad/0]
(root,0,0,00:00:00/1620-01:38:15,713) [xfsdatad/1]
(root,0,0,00:00:00/1620-01:38:15,714) [xfsconvertd/0]
(root,0,0,00:00:00/1620-01:38:15,715) [xfsconvertd/1]
(root,0,0,00:00:13/1620-01:38:15,716) [xfsalloc/0]
(root,0,0,00:00:37/1620-01:38:15,717) [xfsalloc/1]
(root,0,0,00:00:13/1620-01:38:15,718) [xfseofblocks/0]
(root,0,0,00:00:47/1620-01:38:15,719) [xfseofblocks/1]
(root,0,0,00:00:00/1620-01:38:15,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1620-01:38:15,721) [xfs-cil/dm-3]
(root,0,0,00:01:53/1620-01:38:15,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1620-01:38:14,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1620-01:38:12,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1620-01:38:12,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1620-01:38:12,726) [xfssyncd/dm-2]
(root,0,0,08:39:18/1620-01:38:11,727) [xfsaild/dm-2]
(root,0,0,00:18:15/1620-01:37:44,728) [kjournald]
(root,0,0,00:07:59/1620-01:37:43,729) [xfsbufd/dm-5]
(root,0,0,00:06:44/1620-01:37:43,730) [xfs-cil/dm-5]
(root,0,0,00:07:38/1620-01:37:43,731) [xfssyncd/dm-5]
(root,0,0,11:39:49/1620-01:37:43,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1620-01:37:41,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1620-01:37:41,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1620-01:37:41,735) [xfssyncd/dm-7]
(root,0,0,08:41:56/1620-01:37:41,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1620-01:37:39,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1620-01:37:39,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1620-01:37:39,739) [xfssyncd/dm-6]
(root,0,0,08:42:16/1620-01:37:39,740) [xfsaild/dm-6]
(root,0,0,01:18:32/1620-01:37:20,816) [kauditd]
(root,93156,740,05:28:22/1620-01:37:06,1154) auditd
(root,249864,5540,03:03:16/1620-01:37:05,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:05/1620-01:37:04,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1620-01:37:03,1215) rpc.statd
(dbus,21580,1000,00:00:08/1620-01:37:01,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1620-01:36:59,1285) hald
(root,20400,836,00:00:00/1620-01:36:59,1286) hald-runner
(root,452700,1136,00:38:53/1620-01:36:53,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:58:03/1620-01:36:48,1375) /usr/sbin/sshd
(root,21716,804,00:26:26/1620-01:36:47,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:39/1620-01:36:43,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:18/1620-01:36:35,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:45/1620-01:36:34,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:16/1620-01:36:24,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1620-01:36:22,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1620-01:36:22,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1620-01:36:22,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443876,181376,10-03:57:47/1620-01:36:22,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:48/1620-01:36:02,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:07/1620-01:36:02,1759) inet_gethost 4
(root,112532,776,00:00:02/1620-01:36:01,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,607420,213172,01:37:29/1620-01:35:56,1776) /usr/sbin/httpd
(root,116864,704,00:14:00/1620-01:35:55,1786) crond
(root,21104,316,00:00:01/1620-01:35:55,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1620-01:35:55,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1620-01:35:55,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1620-01:35:55,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1620-01:35:55,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1620-01:35:55,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1620-01:35:55,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1620-01:35:55,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3364,00:00:00/01:30:04,4320) pickup -l -t fifo -u
(root,0,0,00:00:01/1-08:46:44,11877) [flush-253:5]
(apache,609116,207192,00:00:00/2-08:43:52,12141) /usr/sbin/httpd
(root,108468,1060,00:00:00/817-09:48:40,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/817-09:48:40,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/817-09:48:40,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15804,2-20:32:38/817-09:48:40,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,66224,3100,00:00:00/00:02,21479) sshd: [accepted] 
(root,66224,3100,00:00:00/00:02,21480) sshd: [accepted] 
(root,67568,3248,00:00:00/00:01,21481) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:01,21482) sshd: [net]      
(root,67568,3204,00:00:00/00:01,21511) sshd: [accepted] 
(sshd,67568,1540,00:00:00/00:01,21518) sshd: [net]      
(root,110268,1492,00:00:00/00:01,21555) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,21573) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,21574) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,607420,202828,00:00:00/3-15:44:01,29954) /usr/sbin/httpd
(apache,609108,207268,00:00:00/3-15:44:00,29961) /usr/sbin/httpd
(apache,609108,207292,00:00:00/3-15:44:00,29976) /usr/sbin/httpd
(apache,609116,207292,00:00:00/3-15:44:00,29987) /usr/sbin/httpd
(apache,609116,207320,00:00:00/3-15:44:00,29997) /usr/sbin/httpd
(apache,609108,207336,00:00:00/3-15:44:00,30009) /usr/sbin/httpd
(apache,609108,207308,00:00:00/3-15:44:00,30023) /usr/sbin/httpd
(apache,609116,207308,00:00:00/3-15:44:00,30034) /usr/sbin/httpd
(apache,609108,207280,00:00:00/3-15:44:00,30046) /usr/sbin/httpd
(apache,609116,207084,00:00:00/1-10:09:22,31582) /usr/sbin/httpd
(apache,609116,207076,00:00:00/1-10:09:21,31583) /usr/sbin/httpd
(apache,609116,207032,00:00:00/1-10:09:20,31584) /usr/sbin/httpd
(apache,609116,207056,00:00:00/1-10:09:19,31585) /usr/sbin/httpd
(apache,609116,207064,00:00:00/1-10:09:19,31586) /usr/sbin/httpd
(apache,609116,207096,00:00:00/1-10:09:19,31587) /usr/sbin/httpd
(apache,609116,207100,00:00:00/1-10:09:19,31588) /usr/sbin/httpd
(apache,609116,207124,00:00:00/1-10:09:14,31596) /usr/sbin/httpd
(apache,609116,207064,00:00:00/1-10:09:11,31600) /usr/sbin/httpd
(apache,609116,207092,00:00:00/1-10:09:01,31617) /usr/sbin/httpd
(apache,609116,207092,00:00:00/1-10:08:54,31629) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-14 00:16

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793954843b8e

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:44/1618-02:00:29,1) /sbin/init
(root,0,0,00:00:05/1618-02:00:29,2) [kthreadd]
(root,0,0,00:14:58/1618-02:00:29,3) [migration/0]
(root,0,0,00:13:12/1618-02:00:29,4) [ksoftirqd/0]
(root,0,0,00:00:00/1618-02:00:29,5) [stopper/0]
(root,0,0,00:04:13/1618-02:00:29,6) [watchdog/0]
(root,0,0,00:22:18/1618-02:00:29,7) [migration/1]
(root,0,0,00:00:00/1618-02:00:29,8) [stopper/1]
(root,0,0,00:07:35/1618-02:00:29,9) [ksoftirqd/1]
(root,0,0,00:03:56/1618-02:00:29,10) [watchdog/1]
(root,0,0,02:53:30/1618-02:00:29,11) [events/0]
(root,0,0,03:04:50/1618-02:00:29,12) [events/1]
(root,0,0,00:00:00/1618-02:00:29,13) [cgroup]
(root,0,0,00:00:00/1618-02:00:29,14) [khelper]
(root,0,0,00:00:00/1618-02:00:29,15) [netns]
(root,0,0,00:00:00/1618-02:00:29,16) [async/mgr]
(root,0,0,00:00:00/1618-02:00:29,17) [pm]
(root,0,0,00:00:00/1618-02:00:29,18) [xenwatch]
(root,0,0,00:00:00/1618-02:00:29,19) [xenbus]
(root,0,0,00:09:15/1618-02:00:29,20) [sync_supers]
(root,0,0,00:10:59/1618-02:00:29,21) [bdi-default]
(root,0,0,00:00:00/1618-02:00:29,22) [kintegrityd/0]
(root,0,0,00:00:00/1618-02:00:29,23) [kintegrityd/1]
(root,0,0,00:09:41/1618-02:00:29,24) [kblockd/0]
(root,0,0,00:01:51/1618-02:00:29,25) [kblockd/1]
(root,0,0,00:00:00/1618-02:00:29,26) [ata_aux]
(root,0,0,00:00:00/1618-02:00:29,27) [ata_sff/0]
(root,0,0,00:00:00/1618-02:00:29,28) [ata_sff/1]
(root,0,0,00:00:00/1618-02:00:29,29) [ksuspend_usbd]
(root,0,0,00:00:00/1618-02:00:29,30) [khubd]
(root,0,0,00:00:00/1618-02:00:29,31) [kseriod]
(root,0,0,00:00:00/1618-02:00:29,32) [md/0]
(root,0,0,00:00:00/1618-02:00:29,33) [md/1]
(root,0,0,00:00:00/1618-02:00:29,34) [md_misc/0]
(root,0,0,00:00:00/1618-02:00:29,35) [md_misc/1]
(root,0,0,00:00:00/1618-02:00:29,36) [linkwatch]
(root,0,0,00:00:53/1618-02:00:29,37) [khungtaskd]
(root,0,0,00:00:07/1618-02:00:29,38) [kswapd0]
(root,0,0,00:00:00/1618-02:00:29,39) [ksmd]
(root,0,0,00:00:00/1618-02:00:29,40) [aio/0]
(root,0,0,00:00:00/1618-02:00:29,41) [aio/1]
(root,0,0,00:00:00/1618-02:00:29,42) [crypto/0]
(root,0,0,00:00:00/1618-02:00:29,43) [crypto/1]
(root,0,0,00:00:00/1618-02:00:29,51) [kthrotld/0]
(root,0,0,00:00:00/1618-02:00:29,52) [kthrotld/1]
(root,0,0,00:00:00/1618-02:00:29,54) [khvcd]
(root,0,0,00:00:00/1618-02:00:29,55) [kpsmoused]
(root,0,0,00:00:00/1618-02:00:29,56) [usbhid_resumer]
(root,0,0,00:00:00/1618-02:00:29,57) [deferwq]
(root,0,0,00:00:00/1618-02:00:29,89) [kdmremove]
(root,0,0,00:00:00/1618-02:00:29,90) [kstriped]
(root,0,0,00:00:00/1618-02:00:24,233) [kdmflush]
(root,0,0,00:00:00/1618-02:00:24,235) [kdmflush]
(root,0,0,00:00:30/1618-02:00:11,252) [kjournald]
(root,10936,368,00:00:00/1618-01:59:51,341) /sbin/udevd -d
(root,0,0,00:00:00/1618-01:59:36,610) [kdmflush]
(root,0,0,00:00:00/1618-01:59:36,613) [kdmflush]
(root,0,0,00:00:00/1618-01:59:36,616) [kdmflush]
(root,0,0,00:00:00/1618-01:59:36,621) [kdmflush]
(root,0,0,00:00:00/1618-01:59:36,627) [kdmflush]
(root,10932,472,00:00:00/1618-01:59:36,628) /sbin/udevd -d
(root,0,0,00:00:00/1618-01:59:36,631) [kdmflush]
(root,10932,436,00:00:00/1618-01:59:36,632) /sbin/udevd -d
(root,0,0,00:17:42/1618-01:59:24,702) [flush-253:4]
(root,0,0,00:00:00/1618-01:59:15,706) [kjournald]
(root,0,0,00:00:00/1618-01:59:14,709) [xfs_mru_cache]
(root,0,0,00:12:12/1618-01:59:14,710) [xfslogd/0]
(root,0,0,00:00:00/1618-01:59:14,711) [xfslogd/1]
(root,0,0,00:16:54/1618-01:59:14,712) [xfsdatad/0]
(root,0,0,00:00:00/1618-01:59:14,713) [xfsdatad/1]
(root,0,0,00:00:00/1618-01:59:14,714) [xfsconvertd/0]
(root,0,0,00:00:00/1618-01:59:14,715) [xfsconvertd/1]
(root,0,0,00:00:13/1618-01:59:14,716) [xfsalloc/0]
(root,0,0,00:00:37/1618-01:59:14,717) [xfsalloc/1]
(root,0,0,00:00:13/1618-01:59:14,718) [xfseofblocks/0]
(root,0,0,00:00:47/1618-01:59:14,719) [xfseofblocks/1]
(root,0,0,00:00:00/1618-01:59:14,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1618-01:59:14,721) [xfs-cil/dm-3]
(root,0,0,00:01:52/1618-01:59:14,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1618-01:59:13,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1618-01:59:11,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1618-01:59:11,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1618-01:59:11,726) [xfssyncd/dm-2]
(root,0,0,08:38:35/1618-01:59:10,727) [xfsaild/dm-2]
(root,0,0,00:18:14/1618-01:58:43,728) [kjournald]
(root,0,0,00:07:58/1618-01:58:42,729) [xfsbufd/dm-5]
(root,0,0,00:06:43/1618-01:58:42,730) [xfs-cil/dm-5]
(root,0,0,00:07:37/1618-01:58:42,731) [xfssyncd/dm-5]
(root,0,0,11:38:56/1618-01:58:42,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1618-01:58:40,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1618-01:58:40,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1618-01:58:40,735) [xfssyncd/dm-7]
(root,0,0,08:41:14/1618-01:58:40,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1618-01:58:38,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1618-01:58:38,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1618-01:58:38,739) [xfssyncd/dm-6]
(root,0,0,08:41:35/1618-01:58:38,740) [xfsaild/dm-6]
(root,0,0,01:18:16/1618-01:58:19,816) [kauditd]
(root,93156,740,05:27:17/1618-01:58:05,1154) auditd
(root,249864,5540,03:02:43/1618-01:58:04,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:05/1618-01:58:03,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1618-01:58:02,1215) rpc.statd
(dbus,21580,1000,00:00:08/1618-01:58:00,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1618-01:57:58,1285) hald
(root,20400,836,00:00:00/1618-01:57:58,1286) hald-runner
(root,67568,3164,00:00:00/01:40,1293) sshd: [accepted] 
(sshd,67568,1392,00:00:00/01:39,1294) sshd: [net]      
(root,452700,1136,00:38:50/1618-01:57:52,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:56:36/1618-01:57:47,1375) /usr/sbin/sshd
(root,21716,804,00:26:24/1618-01:57:46,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:37/1618-01:57:42,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,67568,3248,00:00:00/00:02,1469) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:02,1470) sshd: [net]      
(root,80856,1988,00:11:17/1618-01:57:34,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:44/1618-01:57:33,1555) qmgr -l -t fifo -u
(root,110268,1484,00:00:00/00:01,1562) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,1580) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,1581) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(rabbitmq,10952,624,00:26:14/1618-01:57:23,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1618-01:57:21,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1618-01:57:21,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1618-01:57:21,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443876,186176,10-03:40:12/1618-01:57:21,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:48/1618-01:57:01,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:07/1618-01:57:01,1759) inet_gethost 4
(root,112532,776,00:00:02/1618-01:57:00,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,607420,213172,01:37:19/1618-01:56:55,1776) /usr/sbin/httpd
(root,116864,704,00:13:59/1618-01:56:54,1786) crond
(root,21104,316,00:00:01/1618-01:56:54,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1618-01:56:54,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1618-01:56:54,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1618-01:56:54,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1618-01:56:54,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1618-01:56:54,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1618-01:56:54,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1618-01:56:54,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,609116,207072,00:00:00/09:04:51,12141) /usr/sbin/httpd
(root,0,0,00:00:08/9-07:40:51,19909) [flush-253:5]
(root,108468,1060,00:00:00/815-10:09:39,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/815-10:09:39,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/815-10:09:39,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14980,2-20:21:16/815-10:09:39,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3360,00:00:00/33:33,28982) pickup -l -t fifo -u
(apache,607420,202828,00:00:00/1-16:05:00,29954) /usr/sbin/httpd
(apache,609108,207216,00:00:00/1-16:04:59,29961) /usr/sbin/httpd
(apache,609108,207244,00:00:00/1-16:04:59,29976) /usr/sbin/httpd
(apache,609116,207260,00:00:00/1-16:04:59,29987) /usr/sbin/httpd
(apache,609116,207280,00:00:00/1-16:04:59,29997) /usr/sbin/httpd
(apache,609108,207280,00:00:00/1-16:04:59,30009) /usr/sbin/httpd
(apache,609108,207264,00:00:00/1-16:04:59,30023) /usr/sbin/httpd
(apache,609116,207252,00:00:00/1-16:04:59,30034) /usr/sbin/httpd
(apache,609108,207252,00:00:00/1-16:04:59,30046) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-12 00:37

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79395a7611fd

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:34/1616-01:45:46,1) /sbin/init
(root,0,0,00:00:05/1616-01:45:46,2) [kthreadd]
(root,0,0,00:14:57/1616-01:45:46,3) [migration/0]
(root,0,0,00:13:10/1616-01:45:46,4) [ksoftirqd/0]
(root,0,0,00:00:00/1616-01:45:46,5) [stopper/0]
(root,0,0,00:04:13/1616-01:45:46,6) [watchdog/0]
(root,0,0,00:22:16/1616-01:45:46,7) [migration/1]
(root,0,0,00:00:00/1616-01:45:46,8) [stopper/1]
(root,0,0,00:07:34/1616-01:45:46,9) [ksoftirqd/1]
(root,0,0,00:03:56/1616-01:45:46,10) [watchdog/1]
(root,0,0,02:53:17/1616-01:45:46,11) [events/0]
(root,0,0,03:04:35/1616-01:45:46,12) [events/1]
(root,0,0,00:00:00/1616-01:45:46,13) [cgroup]
(root,0,0,00:00:00/1616-01:45:46,14) [khelper]
(root,0,0,00:00:00/1616-01:45:46,15) [netns]
(root,0,0,00:00:00/1616-01:45:46,16) [async/mgr]
(root,0,0,00:00:00/1616-01:45:46,17) [pm]
(root,0,0,00:00:00/1616-01:45:46,18) [xenwatch]
(root,0,0,00:00:00/1616-01:45:46,19) [xenbus]
(root,0,0,00:09:14/1616-01:45:46,20) [sync_supers]
(root,0,0,00:10:58/1616-01:45:46,21) [bdi-default]
(root,0,0,00:00:00/1616-01:45:46,22) [kintegrityd/0]
(root,0,0,00:00:00/1616-01:45:46,23) [kintegrityd/1]
(root,0,0,00:09:40/1616-01:45:46,24) [kblockd/0]
(root,0,0,00:01:50/1616-01:45:46,25) [kblockd/1]
(root,0,0,00:00:00/1616-01:45:46,26) [ata_aux]
(root,0,0,00:00:00/1616-01:45:46,27) [ata_sff/0]
(root,0,0,00:00:00/1616-01:45:46,28) [ata_sff/1]
(root,0,0,00:00:00/1616-01:45:46,29) [ksuspend_usbd]
(root,0,0,00:00:00/1616-01:45:46,30) [khubd]
(root,0,0,00:00:00/1616-01:45:46,31) [kseriod]
(root,0,0,00:00:00/1616-01:45:46,32) [md/0]
(root,0,0,00:00:00/1616-01:45:46,33) [md/1]
(root,0,0,00:00:00/1616-01:45:46,34) [md_misc/0]
(root,0,0,00:00:00/1616-01:45:46,35) [md_misc/1]
(root,0,0,00:00:00/1616-01:45:46,36) [linkwatch]
(root,0,0,00:00:53/1616-01:45:46,37) [khungtaskd]
(root,0,0,00:00:07/1616-01:45:46,38) [kswapd0]
(root,0,0,00:00:00/1616-01:45:46,39) [ksmd]
(root,0,0,00:00:00/1616-01:45:46,40) [aio/0]
(root,0,0,00:00:00/1616-01:45:46,41) [aio/1]
(root,0,0,00:00:00/1616-01:45:46,42) [crypto/0]
(root,0,0,00:00:00/1616-01:45:46,43) [crypto/1]
(root,0,0,00:00:00/1616-01:45:46,51) [kthrotld/0]
(root,0,0,00:00:00/1616-01:45:46,52) [kthrotld/1]
(root,0,0,00:00:00/1616-01:45:46,54) [khvcd]
(root,0,0,00:00:00/1616-01:45:46,55) [kpsmoused]
(root,0,0,00:00:00/1616-01:45:46,56) [usbhid_resumer]
(root,0,0,00:00:00/1616-01:45:46,57) [deferwq]
(root,0,0,00:00:00/1616-01:45:46,89) [kdmremove]
(root,0,0,00:00:00/1616-01:45:46,90) [kstriped]
(root,0,0,00:00:00/1616-01:45:41,233) [kdmflush]
(root,0,0,00:00:00/1616-01:45:41,235) [kdmflush]
(root,0,0,00:00:30/1616-01:45:28,252) [kjournald]
(root,10936,368,00:00:00/1616-01:45:08,341) /sbin/udevd -d
(root,0,0,00:00:00/1616-01:44:53,610) [kdmflush]
(root,0,0,00:00:00/1616-01:44:53,613) [kdmflush]
(root,0,0,00:00:00/1616-01:44:53,616) [kdmflush]
(root,0,0,00:00:00/1616-01:44:53,621) [kdmflush]
(root,0,0,00:00:00/1616-01:44:53,627) [kdmflush]
(root,10932,472,00:00:00/1616-01:44:53,628) /sbin/udevd -d
(root,0,0,00:00:00/1616-01:44:53,631) [kdmflush]
(root,10932,436,00:00:00/1616-01:44:53,632) /sbin/udevd -d
(root,0,0,00:17:41/1616-01:44:41,702) [flush-253:4]
(root,0,0,00:00:00/1616-01:44:32,706) [kjournald]
(root,0,0,00:00:00/1616-01:44:31,709) [xfs_mru_cache]
(root,0,0,00:12:10/1616-01:44:31,710) [xfslogd/0]
(root,0,0,00:00:00/1616-01:44:31,711) [xfslogd/1]
(root,0,0,00:16:50/1616-01:44:31,712) [xfsdatad/0]
(root,0,0,00:00:00/1616-01:44:31,713) [xfsdatad/1]
(root,0,0,00:00:00/1616-01:44:31,714) [xfsconvertd/0]
(root,0,0,00:00:00/1616-01:44:31,715) [xfsconvertd/1]
(root,0,0,00:00:13/1616-01:44:31,716) [xfsalloc/0]
(root,0,0,00:00:37/1616-01:44:31,717) [xfsalloc/1]
(root,0,0,00:00:12/1616-01:44:31,718) [xfseofblocks/0]
(root,0,0,00:00:47/1616-01:44:31,719) [xfseofblocks/1]
(root,0,0,00:00:00/1616-01:44:31,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1616-01:44:31,721) [xfs-cil/dm-3]
(root,0,0,00:01:52/1616-01:44:31,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1616-01:44:30,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1616-01:44:28,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1616-01:44:28,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1616-01:44:28,726) [xfssyncd/dm-2]
(root,0,0,08:37:53/1616-01:44:27,727) [xfsaild/dm-2]
(root,0,0,00:18:12/1616-01:44:00,728) [kjournald]
(root,0,0,00:07:58/1616-01:43:59,729) [xfsbufd/dm-5]
(root,0,0,00:06:41/1616-01:43:59,730) [xfs-cil/dm-5]
(root,0,0,00:07:36/1616-01:43:59,731) [xfssyncd/dm-5]
(root,0,0,11:38:02/1616-01:43:59,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1616-01:43:57,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1616-01:43:57,734) [xfs-cil/dm-7]
(root,0,0,00:01:53/1616-01:43:57,735) [xfssyncd/dm-7]
(root,0,0,08:40:31/1616-01:43:57,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1616-01:43:55,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1616-01:43:55,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1616-01:43:55,739) [xfssyncd/dm-6]
(root,0,0,08:40:53/1616-01:43:55,740) [xfsaild/dm-6]
(root,0,0,01:17:57/1616-01:43:36,816) [kauditd]
(root,93156,740,05:25:58/1616-01:43:22,1154) auditd
(root,249864,5540,03:02:02/1616-01:43:21,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:04/1616-01:43:20,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1616-01:43:19,1215) rpc.statd
(dbus,21580,1000,00:00:08/1616-01:43:17,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1616-01:43:15,1285) hald
(root,20400,836,00:00:00/1616-01:43:15,1286) hald-runner
(root,452700,1136,00:38:48/1616-01:43:09,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:54:51/1616-01:43:04,1375) /usr/sbin/sshd
(root,21716,804,00:26:22/1616-01:43:03,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:34/1616-01:42:59,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:16/1616-01:42:51,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:44/1616-01:42:50,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:12/1616-01:42:40,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1616-01:42:38,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1616-01:42:38,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1616-01:42:38,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1442716,187056,10-03:21:53/1616-01:42:38,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:48/1616-01:42:18,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:06/1616-01:42:18,1759) inet_gethost 4
(root,112532,776,00:00:02/1616-01:42:17,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,606496,212324,01:37:11/1616-01:42:12,1776) /usr/sbin/httpd
(root,116864,704,00:13:58/1616-01:42:11,1786) crond
(root,21104,316,00:00:01/1616-01:42:11,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1616-01:42:11,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1616-01:42:11,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1616-01:42:11,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1616-01:42:11,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1616-01:42:11,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1616-01:42:11,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1616-01:42:11,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3360,00:00:00/41:22,4976) pickup -l -t fifo -u
(apache,606496,201984,00:00:00/6-15:44:22,5574) /usr/sbin/httpd
(apache,608256,206460,00:00:00/6-15:44:22,5575) /usr/sbin/httpd
(apache,608256,206460,00:00:00/6-15:44:22,5576) /usr/sbin/httpd
(apache,608256,206508,00:00:00/6-15:44:22,5577) /usr/sbin/httpd
(apache,608256,206468,00:00:00/6-15:44:22,5593) /usr/sbin/httpd
(apache,608388,206804,00:00:00/6-15:44:22,5594) /usr/sbin/httpd
(apache,608268,206788,00:00:00/6-15:44:22,5595) /usr/sbin/httpd
(apache,608268,206784,00:00:00/6-15:44:22,5596) /usr/sbin/httpd
(apache,608268,206452,00:00:00/6-15:44:22,5616) /usr/sbin/httpd
(apache,608260,206452,00:00:00/6-15:32:17,7120) /usr/sbin/httpd
(root,67568,3168,00:00:00/01:49,11619) sshd: [accepted] 
(sshd,67568,1396,00:00:00/01:46,11621) sshd: [net]      
(root,67568,3164,00:00:00/01:18,11666) sshd: [accepted] 
(root,66224,3100,00:00:00/01:18,11667) sshd: [accepted] 
(sshd,67568,1396,00:00:00/01:17,11668) sshd: [net]      
(root,67568,3168,00:00:00/00:46,11806) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:44,11810) sshd: [net]      
(root,66224,3104,00:00:00/00:41,11817) sshd: [accepted] 
(root,67568,3168,00:00:00/00:15,11856) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:13,11860) sshd: [net]      
(root,98636,3780,00:00:00/00:05,11961) sshd: adm [priv] 
(root,67568,3244,00:00:00/00:03,11964) sshd: [accepted] 
(root,67568,3244,00:00:00/00:03,11965) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:03,11966) sshd: [net]      
(sshd,67568,1656,00:00:00/00:02,11967) sshd: adm [net]  
(sshd,67568,1572,00:00:00/00:02,11968) sshd: [net]      
(root,110268,1488,00:00:00/00:01,12039) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,12057) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,12058) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,608256,206500,00:00:00/6-01:52:29,12948) /usr/sbin/httpd
(apache,608256,206508,00:00:00/6-01:52:05,13061) /usr/sbin/httpd
(apache,608268,206460,00:00:00/6-01:50:43,13193) /usr/sbin/httpd
(root,0,0,00:00:06/7-07:26:08,19909) [flush-253:5]
(root,108468,1060,00:00:00/813-09:54:56,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/813-09:54:56,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/813-09:54:56,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,16012,2-20:09:48/813-09:54:56,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608268,206472,00:00:00/6-00:00:24,28848) /usr/sbin/httpd
(apache,608268,206748,00:00:00/6-00:00:14,28874) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-10 00:22

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939c99af40f

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:24/1614-00:08:48,1) /sbin/init
(root,0,0,00:00:05/1614-00:08:48,2) [kthreadd]
(root,0,0,00:14:56/1614-00:08:48,3) [migration/0]
(root,0,0,00:13:09/1614-00:08:48,4) [ksoftirqd/0]
(root,0,0,00:00:00/1614-00:08:48,5) [stopper/0]
(root,0,0,00:04:13/1614-00:08:48,6) [watchdog/0]
(root,0,0,00:22:13/1614-00:08:48,7) [migration/1]
(root,0,0,00:00:00/1614-00:08:48,8) [stopper/1]
(root,0,0,00:07:33/1614-00:08:48,9) [ksoftirqd/1]
(root,0,0,00:03:56/1614-00:08:48,10) [watchdog/1]
(root,0,0,02:53:03/1614-00:08:48,11) [events/0]
(root,0,0,03:04:19/1614-00:08:48,12) [events/1]
(root,0,0,00:00:00/1614-00:08:48,13) [cgroup]
(root,0,0,00:00:00/1614-00:08:48,14) [khelper]
(root,0,0,00:00:00/1614-00:08:48,15) [netns]
(root,0,0,00:00:00/1614-00:08:48,16) [async/mgr]
(root,0,0,00:00:00/1614-00:08:48,17) [pm]
(root,0,0,00:00:00/1614-00:08:48,18) [xenwatch]
(root,0,0,00:00:00/1614-00:08:48,19) [xenbus]
(root,0,0,00:09:13/1614-00:08:48,20) [sync_supers]
(root,0,0,00:10:57/1614-00:08:48,21) [bdi-default]
(root,0,0,00:00:00/1614-00:08:48,22) [kintegrityd/0]
(root,0,0,00:00:00/1614-00:08:48,23) [kintegrityd/1]
(root,0,0,00:09:39/1614-00:08:48,24) [kblockd/0]
(root,0,0,00:01:50/1614-00:08:48,25) [kblockd/1]
(root,0,0,00:00:00/1614-00:08:48,26) [ata_aux]
(root,0,0,00:00:00/1614-00:08:48,27) [ata_sff/0]
(root,0,0,00:00:00/1614-00:08:48,28) [ata_sff/1]
(root,0,0,00:00:00/1614-00:08:48,29) [ksuspend_usbd]
(root,0,0,00:00:00/1614-00:08:48,30) [khubd]
(root,0,0,00:00:00/1614-00:08:48,31) [kseriod]
(root,0,0,00:00:00/1614-00:08:48,32) [md/0]
(root,0,0,00:00:00/1614-00:08:48,33) [md/1]
(root,0,0,00:00:00/1614-00:08:48,34) [md_misc/0]
(root,0,0,00:00:00/1614-00:08:48,35) [md_misc/1]
(root,0,0,00:00:00/1614-00:08:48,36) [linkwatch]
(root,0,0,00:00:53/1614-00:08:48,37) [khungtaskd]
(root,0,0,00:00:07/1614-00:08:48,38) [kswapd0]
(root,0,0,00:00:00/1614-00:08:48,39) [ksmd]
(root,0,0,00:00:00/1614-00:08:48,40) [aio/0]
(root,0,0,00:00:00/1614-00:08:48,41) [aio/1]
(root,0,0,00:00:00/1614-00:08:48,42) [crypto/0]
(root,0,0,00:00:00/1614-00:08:48,43) [crypto/1]
(root,0,0,00:00:00/1614-00:08:48,51) [kthrotld/0]
(root,0,0,00:00:00/1614-00:08:48,52) [kthrotld/1]
(root,0,0,00:00:00/1614-00:08:48,54) [khvcd]
(root,0,0,00:00:00/1614-00:08:48,55) [kpsmoused]
(root,0,0,00:00:00/1614-00:08:48,56) [usbhid_resumer]
(root,0,0,00:00:00/1614-00:08:48,57) [deferwq]
(root,0,0,00:00:00/1614-00:08:48,89) [kdmremove]
(root,0,0,00:00:00/1614-00:08:48,90) [kstriped]
(root,0,0,00:00:00/1614-00:08:43,233) [kdmflush]
(root,0,0,00:00:00/1614-00:08:43,235) [kdmflush]
(root,0,0,00:00:29/1614-00:08:30,252) [kjournald]
(root,10936,368,00:00:00/1614-00:08:10,341) /sbin/udevd -d
(root,0,0,00:00:00/1614-00:07:55,610) [kdmflush]
(root,0,0,00:00:00/1614-00:07:55,613) [kdmflush]
(root,0,0,00:00:00/1614-00:07:55,616) [kdmflush]
(root,0,0,00:00:00/1614-00:07:55,621) [kdmflush]
(root,0,0,00:00:00/1614-00:07:55,627) [kdmflush]
(root,10932,472,00:00:00/1614-00:07:55,628) /sbin/udevd -d
(root,0,0,00:00:00/1614-00:07:55,631) [kdmflush]
(root,10932,436,00:00:00/1614-00:07:55,632) /sbin/udevd -d
(root,0,0,00:17:39/1614-00:07:43,702) [flush-253:4]
(root,0,0,00:00:00/1614-00:07:34,706) [kjournald]
(root,0,0,00:00:00/1614-00:07:33,709) [xfs_mru_cache]
(root,0,0,00:12:07/1614-00:07:33,710) [xfslogd/0]
(root,0,0,00:00:00/1614-00:07:33,711) [xfslogd/1]
(root,0,0,00:16:47/1614-00:07:33,712) [xfsdatad/0]
(root,0,0,00:00:00/1614-00:07:33,713) [xfsdatad/1]
(root,0,0,00:00:00/1614-00:07:33,714) [xfsconvertd/0]
(root,0,0,00:00:00/1614-00:07:33,715) [xfsconvertd/1]
(root,0,0,00:00:13/1614-00:07:33,716) [xfsalloc/0]
(root,0,0,00:00:37/1614-00:07:33,717) [xfsalloc/1]
(root,0,0,00:00:12/1614-00:07:33,718) [xfseofblocks/0]
(root,0,0,00:00:47/1614-00:07:33,719) [xfseofblocks/1]
(root,0,0,00:00:00/1614-00:07:33,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1614-00:07:33,721) [xfs-cil/dm-3]
(root,0,0,00:01:52/1614-00:07:33,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1614-00:07:32,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1614-00:07:30,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1614-00:07:30,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1614-00:07:30,726) [xfssyncd/dm-2]
(root,0,0,08:37:12/1614-00:07:29,727) [xfsaild/dm-2]
(root,0,0,00:18:11/1614-00:07:02,728) [kjournald]
(root,0,0,00:07:57/1614-00:07:01,729) [xfsbufd/dm-5]
(root,0,0,00:06:40/1614-00:07:01,730) [xfs-cil/dm-5]
(root,0,0,00:07:36/1614-00:07:01,731) [xfssyncd/dm-5]
(root,0,0,11:37:05/1614-00:07:01,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1614-00:06:59,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1614-00:06:59,734) [xfs-cil/dm-7]
(root,0,0,00:01:52/1614-00:06:59,735) [xfssyncd/dm-7]
(root,0,0,08:39:50/1614-00:06:59,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1614-00:06:57,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1614-00:06:57,738) [xfs-cil/dm-6]
(root,0,0,00:01:56/1614-00:06:57,739) [xfssyncd/dm-6]
(root,0,0,08:40:12/1614-00:06:57,740) [xfsaild/dm-6]
(root,0,0,01:17:36/1614-00:06:38,816) [kauditd]
(root,93156,740,05:24:31/1614-00:06:24,1154) auditd
(root,249864,5540,03:01:16/1614-00:06:23,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:04/1614-00:06:22,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1614-00:06:21,1215) rpc.statd
(dbus,21580,1000,00:00:08/1614-00:06:19,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1614-00:06:17,1285) hald
(root,20400,836,00:00:00/1614-00:06:17,1286) hald-runner
(root,452700,1136,00:38:45/1614-00:06:11,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:52:49/1614-00:06:06,1375) /usr/sbin/sshd
(root,21716,804,00:26:20/1614-00:06:05,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:32/1614-00:06:01,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:15/1614-00:05:53,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:44/1614-00:05:52,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:10/1614-00:05:42,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1614-00:05:40,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1614-00:05:40,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1614-00:05:40,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1443228,186048,10-03:02:35/1614-00:05:40,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:48/1614-00:05:20,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:06/1614-00:05:20,1759) inet_gethost 4
(root,112532,776,00:00:02/1614-00:05:19,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,606496,212324,01:37:03/1614-00:05:14,1776) /usr/sbin/httpd
(root,116864,704,00:13:57/1614-00:05:13,1786) crond
(root,21104,316,00:00:01/1614-00:05:13,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1614-00:05:13,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1614-00:05:13,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1614-00:05:13,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1614-00:05:13,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1614-00:05:13,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1614-00:05:13,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1614-00:05:13,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3368,00:00:00/01:06:57,5453) pickup -l -t fifo -u
(apache,606496,201984,00:00:00/4-14:07:24,5574) /usr/sbin/httpd
(apache,608256,206424,00:00:00/4-14:07:24,5575) /usr/sbin/httpd
(apache,608256,206440,00:00:00/4-14:07:24,5576) /usr/sbin/httpd
(apache,608256,206496,00:00:00/4-14:07:24,5577) /usr/sbin/httpd
(apache,608256,206464,00:00:00/4-14:07:24,5593) /usr/sbin/httpd
(apache,608388,206784,00:00:00/4-14:07:24,5594) /usr/sbin/httpd
(apache,608268,206784,00:00:00/4-14:07:24,5595) /usr/sbin/httpd
(apache,608268,206776,00:00:00/4-14:07:24,5596) /usr/sbin/httpd
(apache,608268,206432,00:00:00/4-14:07:24,5616) /usr/sbin/httpd
(apache,608260,206424,00:00:00/4-13:55:19,7120) /usr/sbin/httpd
(apache,608256,206476,00:00:00/4-00:15:31,12948) /usr/sbin/httpd
(apache,608256,206488,00:00:00/4-00:15:07,13061) /usr/sbin/httpd
(apache,608268,206444,00:00:00/4-00:13:45,13193) /usr/sbin/httpd
(root,67568,3168,00:00:00/01:39,19263) sshd: [accepted] 
(sshd,67568,1400,00:00:00/01:38,19267) sshd: [net]      
(root,67568,3168,00:00:00/00:18,19616) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:15,19627) sshd: [net]      
(root,67568,3168,00:00:00/00:06,19645) sshd: [accepted] 
(sshd,67568,1404,00:00:00/00:04,19652) sshd: [net]      
(root,66224,3104,00:00:00/00:03,19653) sshd: [accepted] 
(root,67568,3248,00:00:00/00:03,19654) sshd: [accepted] 
(sshd,67568,1576,00:00:00/00:03,19655) sshd: [net]      
(root,67568,3244,00:00:00/00:03,19656) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:02,19657) sshd: [net]      
(root,67568,3212,00:00:00/00:01,19710) sshd: [accepted] 
(sshd,67568,1540,00:00:00/00:01,19714) sshd: [net]      
(root,110268,1492,00:00:00/00:01,19730) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,19748) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,19749) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:04/5-05:49:10,19909) [flush-253:5]
(root,108468,1060,00:00:00/811-08:17:58,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/811-08:17:58,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/811-08:17:58,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,16840,2-19:57:48/811-08:17:58,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608268,206428,00:00:00/3-22:23:26,28848) /usr/sbin/httpd
(apache,608268,206728,00:00:00/3-22:23:16,28874) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-07 22:45

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793911601cc8

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:13/1611-23:54:00,1) /sbin/init
(root,0,0,00:00:05/1611-23:54:00,2) [kthreadd]
(root,0,0,00:14:55/1611-23:54:00,3) [migration/0]
(root,0,0,00:13:07/1611-23:54:00,4) [ksoftirqd/0]
(root,0,0,00:00:00/1611-23:54:00,5) [stopper/0]
(root,0,0,00:04:12/1611-23:54:00,6) [watchdog/0]
(root,0,0,00:22:10/1611-23:54:00,7) [migration/1]
(root,0,0,00:00:00/1611-23:54:00,8) [stopper/1]
(root,0,0,00:07:32/1611-23:54:00,9) [ksoftirqd/1]
(root,0,0,00:03:55/1611-23:54:00,10) [watchdog/1]
(root,0,0,02:52:50/1611-23:54:00,11) [events/0]
(root,0,0,03:04:04/1611-23:54:00,12) [events/1]
(root,0,0,00:00:00/1611-23:54:00,13) [cgroup]
(root,0,0,00:00:00/1611-23:54:00,14) [khelper]
(root,0,0,00:00:00/1611-23:54:00,15) [netns]
(root,0,0,00:00:00/1611-23:54:00,16) [async/mgr]
(root,0,0,00:00:00/1611-23:54:00,17) [pm]
(root,0,0,00:00:00/1611-23:54:00,18) [xenwatch]
(root,0,0,00:00:00/1611-23:54:00,19) [xenbus]
(root,0,0,00:09:12/1611-23:54:00,20) [sync_supers]
(root,0,0,00:10:56/1611-23:54:00,21) [bdi-default]
(root,0,0,00:00:00/1611-23:54:00,22) [kintegrityd/0]
(root,0,0,00:00:00/1611-23:54:00,23) [kintegrityd/1]
(root,0,0,00:09:38/1611-23:54:00,24) [kblockd/0]
(root,0,0,00:01:50/1611-23:54:00,25) [kblockd/1]
(root,0,0,00:00:00/1611-23:54:00,26) [ata_aux]
(root,0,0,00:00:00/1611-23:54:00,27) [ata_sff/0]
(root,0,0,00:00:00/1611-23:54:00,28) [ata_sff/1]
(root,0,0,00:00:00/1611-23:54:00,29) [ksuspend_usbd]
(root,0,0,00:00:00/1611-23:54:00,30) [khubd]
(root,0,0,00:00:00/1611-23:54:00,31) [kseriod]
(root,0,0,00:00:00/1611-23:54:00,32) [md/0]
(root,0,0,00:00:00/1611-23:54:00,33) [md/1]
(root,0,0,00:00:00/1611-23:54:00,34) [md_misc/0]
(root,0,0,00:00:00/1611-23:54:00,35) [md_misc/1]
(root,0,0,00:00:00/1611-23:54:00,36) [linkwatch]
(root,0,0,00:00:53/1611-23:54:00,37) [khungtaskd]
(root,0,0,00:00:07/1611-23:54:00,38) [kswapd0]
(root,0,0,00:00:00/1611-23:54:00,39) [ksmd]
(root,0,0,00:00:00/1611-23:54:00,40) [aio/0]
(root,0,0,00:00:00/1611-23:54:00,41) [aio/1]
(root,0,0,00:00:00/1611-23:54:00,42) [crypto/0]
(root,0,0,00:00:00/1611-23:54:00,43) [crypto/1]
(root,0,0,00:00:00/1611-23:54:00,51) [kthrotld/0]
(root,0,0,00:00:00/1611-23:54:00,52) [kthrotld/1]
(root,0,0,00:00:00/1611-23:54:00,54) [khvcd]
(root,0,0,00:00:00/1611-23:54:00,55) [kpsmoused]
(root,0,0,00:00:00/1611-23:54:00,56) [usbhid_resumer]
(root,0,0,00:00:00/1611-23:54:00,57) [deferwq]
(root,0,0,00:00:00/1611-23:54:00,89) [kdmremove]
(root,0,0,00:00:00/1611-23:54:00,90) [kstriped]
(root,0,0,00:00:00/1611-23:53:55,233) [kdmflush]
(root,0,0,00:00:00/1611-23:53:55,235) [kdmflush]
(root,0,0,00:00:29/1611-23:53:42,252) [kjournald]
(root,10936,368,00:00:00/1611-23:53:22,341) /sbin/udevd -d
(root,0,0,00:00:00/1611-23:53:07,610) [kdmflush]
(root,0,0,00:00:00/1611-23:53:07,613) [kdmflush]
(root,0,0,00:00:00/1611-23:53:07,616) [kdmflush]
(root,0,0,00:00:00/1611-23:53:07,621) [kdmflush]
(root,0,0,00:00:00/1611-23:53:07,627) [kdmflush]
(root,10932,472,00:00:00/1611-23:53:07,628) /sbin/udevd -d
(root,0,0,00:00:00/1611-23:53:07,631) [kdmflush]
(root,10932,436,00:00:00/1611-23:53:07,632) /sbin/udevd -d
(root,0,0,00:17:38/1611-23:52:55,702) [flush-253:4]
(root,0,0,00:00:00/1611-23:52:46,706) [kjournald]
(root,0,0,00:00:00/1611-23:52:45,709) [xfs_mru_cache]
(root,0,0,00:12:05/1611-23:52:45,710) [xfslogd/0]
(root,0,0,00:00:00/1611-23:52:45,711) [xfslogd/1]
(root,0,0,00:16:44/1611-23:52:45,712) [xfsdatad/0]
(root,0,0,00:00:00/1611-23:52:45,713) [xfsdatad/1]
(root,0,0,00:00:00/1611-23:52:45,714) [xfsconvertd/0]
(root,0,0,00:00:00/1611-23:52:45,715) [xfsconvertd/1]
(root,0,0,00:00:13/1611-23:52:45,716) [xfsalloc/0]
(root,0,0,00:00:37/1611-23:52:45,717) [xfsalloc/1]
(root,0,0,00:00:12/1611-23:52:45,718) [xfseofblocks/0]
(root,0,0,00:00:47/1611-23:52:45,719) [xfseofblocks/1]
(root,0,0,00:00:00/1611-23:52:45,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1611-23:52:45,721) [xfs-cil/dm-3]
(root,0,0,00:01:52/1611-23:52:45,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1611-23:52:44,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1611-23:52:42,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1611-23:52:42,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1611-23:52:42,726) [xfssyncd/dm-2]
(root,0,0,08:36:30/1611-23:52:41,727) [xfsaild/dm-2]
(root,0,0,00:18:09/1611-23:52:14,728) [kjournald]
(root,0,0,00:07:57/1611-23:52:13,729) [xfsbufd/dm-5]
(root,0,0,00:06:39/1611-23:52:13,730) [xfs-cil/dm-5]
(root,0,0,00:07:35/1611-23:52:13,731) [xfssyncd/dm-5]
(root,0,0,11:36:12/1611-23:52:13,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1611-23:52:11,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1611-23:52:11,734) [xfs-cil/dm-7]
(root,0,0,00:01:52/1611-23:52:11,735) [xfssyncd/dm-7]
(root,0,0,08:39:07/1611-23:52:11,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1611-23:52:09,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1611-23:52:09,738) [xfs-cil/dm-6]
(root,0,0,00:01:55/1611-23:52:09,739) [xfssyncd/dm-6]
(root,0,0,08:39:31/1611-23:52:09,740) [xfsaild/dm-6]
(root,0,0,01:17:16/1611-23:51:50,816) [kauditd]
(root,93156,740,05:23:09/1611-23:51:36,1154) auditd
(root,249864,5540,03:00:32/1611-23:51:35,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:04/1611-23:51:34,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1611-23:51:33,1215) rpc.statd
(dbus,21580,1000,00:00:07/1611-23:51:31,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1611-23:51:29,1285) hald
(root,20400,836,00:00:00/1611-23:51:29,1286) hald-runner
(root,452700,1136,00:38:42/1611-23:51:23,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:50:46/1611-23:51:18,1375) /usr/sbin/sshd
(root,21716,804,00:26:18/1611-23:51:17,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:30/1611-23:51:13,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:15/1611-23:51:05,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:44/1611-23:51:04,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:08/1611-23:50:54,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1611-23:50:52,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1611-23:50:52,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1611-23:50:52,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1444204,186628,10-02:44:00/1611-23:50:52,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:48/1611-23:50:32,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:06/1611-23:50:32,1759) inet_gethost 4
(root,112532,776,00:00:02/1611-23:50:31,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,606496,212324,01:36:56/1611-23:50:26,1776) /usr/sbin/httpd
(root,116864,704,00:13:56/1611-23:50:25,1786) crond
(root,21104,316,00:00:01/1611-23:50:25,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1611-23:50:25,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1611-23:50:25,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1611-23:50:25,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1611-23:50:25,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1611-23:50:25,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1611-23:50:25,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1611-23:50:25,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,606496,201984,00:00:00/2-13:52:36,5574) /usr/sbin/httpd
(apache,608256,206404,00:00:00/2-13:52:36,5575) /usr/sbin/httpd
(apache,608256,206372,00:00:00/2-13:52:36,5576) /usr/sbin/httpd
(apache,608256,206452,00:00:00/2-13:52:36,5577) /usr/sbin/httpd
(apache,608256,206412,00:00:00/2-13:52:36,5593) /usr/sbin/httpd
(apache,608388,206736,00:00:00/2-13:52:36,5594) /usr/sbin/httpd
(apache,608268,206736,00:00:00/2-13:52:36,5595) /usr/sbin/httpd
(apache,608268,206724,00:00:00/2-13:52:36,5596) /usr/sbin/httpd
(apache,608268,206408,00:00:00/2-13:52:36,5616) /usr/sbin/httpd
(apache,608260,206388,00:00:00/2-13:40:31,7120) /usr/sbin/httpd
(root,66224,3104,00:00:00/01:49,8288) sshd: [accepted] 
(root,66224,3100,00:00:00/01:42,8396) sshd: [accepted] 
(root,0,0,00:00:00/00:56,8459) [flush-253:1]
(root,66224,3104,00:00:00/00:31,8578) sshd: [accepted] 
(root,67568,3240,00:00:00/00:05,8604) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:04,8605) sshd: [net]      
(root,67568,3164,00:00:00/00:01,8606) sshd: [accepted] 
(sshd,67568,1396,00:00:00/00:01,8630) sshd: [net]      
(root,110268,1488,00:00:00/00:01,8631) /bin/bash /usr/bin/check_mk_agent
(root,13368,972,00:00:00/00:01,8649) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,804,00:00:00/00:01,8650) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,608256,206424,00:00:00/2-00:00:43,12948) /usr/sbin/httpd
(apache,608256,206452,00:00:00/2-00:00:19,13061) /usr/sbin/httpd
(apache,608268,206388,00:00:00/1-23:58:57,13193) /usr/sbin/httpd
(root,0,0,00:00:02/3-05:34:22,19909) [flush-253:5]
(root,108468,1060,00:00:00/809-08:03:10,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/809-08:03:10,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/809-08:03:10,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14976,2-19:46:15/809-08:03:10,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,608268,206368,00:00:00/1-22:08:38,28848) /usr/sbin/httpd
(postfix,80944,3360,00:00:00/01:14:36,28850) pickup -l -t fifo -u
(apache,608268,206676,00:00:00/1-22:08:28,28874) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-05 22:30

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939bcde3dc5

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:36:11/1610-02:16:04,1) /sbin/init
(root,0,0,00:00:05/1610-02:16:04,2) [kthreadd]
(root,0,0,00:14:54/1610-02:16:04,3) [migration/0]
(root,0,0,00:13:06/1610-02:16:04,4) [ksoftirqd/0]
(root,0,0,00:00:00/1610-02:16:04,5) [stopper/0]
(root,0,0,00:04:12/1610-02:16:04,6) [watchdog/0]
(root,0,0,00:22:08/1610-02:16:04,7) [migration/1]
(root,0,0,00:00:00/1610-02:16:04,8) [stopper/1]
(root,0,0,00:07:32/1610-02:16:04,9) [ksoftirqd/1]
(root,0,0,00:03:55/1610-02:16:04,10) [watchdog/1]
(root,0,0,02:52:37/1610-02:16:04,11) [events/0]
(root,0,0,03:03:50/1610-02:16:04,12) [events/1]
(root,0,0,00:00:00/1610-02:16:04,13) [cgroup]
(root,0,0,00:00:00/1610-02:16:04,14) [khelper]
(root,0,0,00:00:00/1610-02:16:04,15) [netns]
(root,0,0,00:00:00/1610-02:16:04,16) [async/mgr]
(root,0,0,00:00:00/1610-02:16:04,17) [pm]
(root,0,0,00:00:00/1610-02:16:04,18) [xenwatch]
(root,0,0,00:00:00/1610-02:16:04,19) [xenbus]
(root,0,0,00:09:12/1610-02:16:04,20) [sync_supers]
(root,0,0,00:10:55/1610-02:16:04,21) [bdi-default]
(root,0,0,00:00:00/1610-02:16:04,22) [kintegrityd/0]
(root,0,0,00:00:00/1610-02:16:04,23) [kintegrityd/1]
(root,0,0,00:09:37/1610-02:16:04,24) [kblockd/0]
(root,0,0,00:01:50/1610-02:16:04,25) [kblockd/1]
(root,0,0,00:00:00/1610-02:16:04,26) [ata_aux]
(root,0,0,00:00:00/1610-02:16:04,27) [ata_sff/0]
(root,0,0,00:00:00/1610-02:16:04,28) [ata_sff/1]
(root,0,0,00:00:00/1610-02:16:04,29) [ksuspend_usbd]
(root,0,0,00:00:00/1610-02:16:04,30) [khubd]
(root,0,0,00:00:00/1610-02:16:04,31) [kseriod]
(root,0,0,00:00:00/1610-02:16:04,32) [md/0]
(root,0,0,00:00:00/1610-02:16:04,33) [md/1]
(root,0,0,00:00:00/1610-02:16:04,34) [md_misc/0]
(root,0,0,00:00:00/1610-02:16:04,35) [md_misc/1]
(root,0,0,00:00:00/1610-02:16:04,36) [linkwatch]
(root,0,0,00:00:52/1610-02:16:04,37) [khungtaskd]
(root,0,0,00:00:07/1610-02:16:04,38) [kswapd0]
(root,0,0,00:00:00/1610-02:16:04,39) [ksmd]
(root,0,0,00:00:00/1610-02:16:04,40) [aio/0]
(root,0,0,00:00:00/1610-02:16:04,41) [aio/1]
(root,0,0,00:00:00/1610-02:16:04,42) [crypto/0]
(root,0,0,00:00:00/1610-02:16:04,43) [crypto/1]
(root,0,0,00:00:00/1610-02:16:04,51) [kthrotld/0]
(root,0,0,00:00:00/1610-02:16:04,52) [kthrotld/1]
(root,0,0,00:00:00/1610-02:16:04,54) [khvcd]
(root,0,0,00:00:00/1610-02:16:04,55) [kpsmoused]
(root,0,0,00:00:00/1610-02:16:04,56) [usbhid_resumer]
(root,0,0,00:00:00/1610-02:16:04,57) [deferwq]
(root,0,0,00:00:00/1610-02:16:04,89) [kdmremove]
(root,0,0,00:00:00/1610-02:16:04,90) [kstriped]
(root,0,0,00:00:00/1610-02:15:59,233) [kdmflush]
(root,0,0,00:00:00/1610-02:15:59,235) [kdmflush]
(root,0,0,00:00:29/1610-02:15:46,252) [kjournald]
(root,10936,368,00:00:00/1610-02:15:26,341) /sbin/udevd -d
(root,101288,4268,00:00:00/00:07,384) sshd: root [priv]
(sshd,67568,1656,00:00:00/00:06,385) sshd: root [net] 
(root,110268,1488,00:00:00/00:01,450) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,468) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8388,712,00:00:00/00:01,469) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:00/1610-02:15:11,610) [kdmflush]
(root,0,0,00:00:00/1610-02:15:11,613) [kdmflush]
(root,0,0,00:00:00/1610-02:15:11,616) [kdmflush]
(root,0,0,00:00:00/1610-02:15:11,621) [kdmflush]
(root,0,0,00:00:00/1610-02:15:11,627) [kdmflush]
(root,10932,472,00:00:00/1610-02:15:11,628) /sbin/udevd -d
(root,0,0,00:00:00/1610-02:15:11,631) [kdmflush]
(root,10932,436,00:00:00/1610-02:15:11,632) /sbin/udevd -d
(root,0,0,00:17:37/1610-02:14:59,702) [flush-253:4]
(root,0,0,00:00:00/1610-02:14:50,706) [kjournald]
(root,0,0,00:00:00/1610-02:14:49,709) [xfs_mru_cache]
(root,0,0,00:12:04/1610-02:14:49,710) [xfslogd/0]
(root,0,0,00:00:00/1610-02:14:49,711) [xfslogd/1]
(root,0,0,00:16:42/1610-02:14:49,712) [xfsdatad/0]
(root,0,0,00:00:00/1610-02:14:49,713) [xfsdatad/1]
(root,0,0,00:00:00/1610-02:14:49,714) [xfsconvertd/0]
(root,0,0,00:00:00/1610-02:14:49,715) [xfsconvertd/1]
(root,0,0,00:00:13/1610-02:14:49,716) [xfsalloc/0]
(root,0,0,00:00:37/1610-02:14:49,717) [xfsalloc/1]
(root,0,0,00:00:12/1610-02:14:49,718) [xfseofblocks/0]
(root,0,0,00:00:47/1610-02:14:49,719) [xfseofblocks/1]
(root,0,0,00:00:00/1610-02:14:49,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1610-02:14:49,721) [xfs-cil/dm-3]
(root,0,0,00:01:52/1610-02:14:49,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1610-02:14:48,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1610-02:14:46,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1610-02:14:46,725) [xfs-cil/dm-2]
(root,0,0,00:01:54/1610-02:14:46,726) [xfssyncd/dm-2]
(root,0,0,08:35:49/1610-02:14:45,727) [xfsaild/dm-2]
(root,0,0,00:18:08/1610-02:14:18,728) [kjournald]
(root,0,0,00:07:56/1610-02:14:17,729) [xfsbufd/dm-5]
(root,0,0,00:06:38/1610-02:14:17,730) [xfs-cil/dm-5]
(root,0,0,00:07:35/1610-02:14:17,731) [xfssyncd/dm-5]
(root,0,0,11:35:21/1610-02:14:17,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1610-02:14:15,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1610-02:14:15,734) [xfs-cil/dm-7]
(root,0,0,00:01:52/1610-02:14:15,735) [xfssyncd/dm-7]
(root,0,0,08:38:30/1610-02:14:15,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1610-02:14:13,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1610-02:14:13,738) [xfs-cil/dm-6]
(root,0,0,00:01:55/1610-02:14:13,739) [xfssyncd/dm-6]
(root,0,0,08:38:53/1610-02:14:13,740) [xfsaild/dm-6]
(root,0,0,01:17:11/1610-02:13:54,816) [kauditd]
(root,93156,740,05:22:45/1610-02:13:40,1154) auditd
(root,249864,5540,03:00:18/1610-02:13:39,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:07:03/1610-02:13:38,1195) rpcbind
(rpcuser,23404,1100,00:00:00/1610-02:13:37,1215) rpc.statd
(dbus,21580,1000,00:00:07/1610-02:13:35,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1610-02:13:33,1285) hald
(root,20400,836,00:00:00/1610-02:13:33,1286) hald-runner
(root,452700,1136,00:38:39/1610-02:13:27,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:50:07/1610-02:13:22,1375) /usr/sbin/sshd
(root,21716,804,00:26:16/1610-02:13:21,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:32:27/1610-02:13:17,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:11:14/1610-02:13:09,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:44/1610-02:13:08,1555) qmgr -l -t fifo -u
(rabbitmq,10952,624,00:26:06/1610-02:12:58,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1610-02:12:56,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1610-02:12:56,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1610-02:12:56,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1442716,187048,10-02:26:16/1610-02:12:56,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:47/1610-02:12:36,1758) inet_gethost 4
(rabbitmq,17120,804,00:05:05/1610-02:12:36,1759) inet_gethost 4
(root,112532,776,00:00:02/1610-02:12:35,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,606496,212324,01:36:49/1610-02:12:30,1776) /usr/sbin/httpd
(root,116864,704,00:13:55/1610-02:12:29,1786) crond
(root,21104,316,00:00:01/1610-02:12:29,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1610-02:12:29,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1610-02:12:29,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1610-02:12:29,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1610-02:12:29,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1610-02:12:29,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1610-02:12:29,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1610-02:12:29,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,606496,201984,00:00:00/16:14:40,5574) /usr/sbin/httpd
(apache,608256,206264,00:00:00/16:14:40,5575) /usr/sbin/httpd
(apache,608256,206256,00:00:00/16:14:40,5576) /usr/sbin/httpd
(apache,608256,206292,00:00:00/16:14:40,5577) /usr/sbin/httpd
(apache,608256,206268,00:00:00/16:14:40,5593) /usr/sbin/httpd
(apache,608388,206596,00:00:00/16:14:40,5594) /usr/sbin/httpd
(apache,608268,206556,00:00:00/16:14:40,5595) /usr/sbin/httpd
(apache,608268,206544,00:00:00/16:14:40,5596) /usr/sbin/httpd
(apache,608268,206304,00:00:00/16:14:40,5616) /usr/sbin/httpd
(apache,608260,206260,00:00:00/16:02:35,7120) /usr/sbin/httpd
(apache,608256,206228,00:00:00/02:22:47,12948) /usr/sbin/httpd
(apache,608256,206204,00:00:00/02:22:23,13061) /usr/sbin/httpd
(apache,608268,206204,00:00:00/02:21:01,13193) /usr/sbin/httpd
(root,0,0,00:00:00/1-07:56:26,19909) [flush-253:5]
(root,108468,1060,00:00:00/807-10:25:14,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/807-10:25:14,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/807-10:25:14,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15552,2-19:35:27/807-10:25:14,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/38:56,27632) pickup -l -t fifo -u
(apache,608268,206040,00:00:00/30:42,28848) /usr/sbin/httpd
(apache,608268,206008,00:00:00/30:32,28874) /usr/sbin/httpd
(root,0,0,00:00:00/03:01,32470) [flush-253:1]
(root,66224,3100,00:00:00/01:59,32596) sshd: [accepted] 
(root,66224,3104,00:00:00/01:47,32604) sshd: [accepted] 
(root,67568,3212,00:00:00/01:16,32718) sshd: [accepted] 
(sshd,67568,1448,00:00:00/01:16,32719) sshd: [net]      

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-11-04 00:53

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939955c79c4

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:19/1521-21:24:08,1) /sbin/init
(root,0,0,00:00:05/1521-21:24:08,2) [kthreadd]
(root,0,0,00:14:04/1521-21:24:08,3) [migration/0]
(root,0,0,00:12:16/1521-21:24:08,4) [ksoftirqd/0]
(root,0,0,00:00:00/1521-21:24:08,5) [stopper/0]
(root,0,0,00:03:58/1521-21:24:08,6) [watchdog/0]
(root,0,0,00:20:46/1521-21:24:08,7) [migration/1]
(root,0,0,00:00:00/1521-21:24:08,8) [stopper/1]
(root,0,0,00:07:03/1521-21:24:08,9) [ksoftirqd/1]
(root,0,0,00:03:42/1521-21:24:08,10) [watchdog/1]
(root,0,0,02:42:38/1521-21:24:08,11) [events/0]
(root,0,0,02:53:10/1521-21:24:08,12) [events/1]
(root,0,0,00:00:00/1521-21:24:08,13) [cgroup]
(root,0,0,00:00:00/1521-21:24:08,14) [khelper]
(root,0,0,00:00:00/1521-21:24:08,15) [netns]
(root,0,0,00:00:00/1521-21:24:08,16) [async/mgr]
(root,0,0,00:00:00/1521-21:24:08,17) [pm]
(root,0,0,00:00:00/1521-21:24:08,18) [xenwatch]
(root,0,0,00:00:00/1521-21:24:08,19) [xenbus]
(root,0,0,00:08:41/1521-21:24:08,20) [sync_supers]
(root,0,0,00:10:18/1521-21:24:08,21) [bdi-default]
(root,0,0,00:00:00/1521-21:24:08,22) [kintegrityd/0]
(root,0,0,00:00:00/1521-21:24:08,23) [kintegrityd/1]
(root,0,0,00:09:01/1521-21:24:08,24) [kblockd/0]
(root,0,0,00:01:43/1521-21:24:08,25) [kblockd/1]
(root,0,0,00:00:00/1521-21:24:08,26) [ata_aux]
(root,0,0,00:00:00/1521-21:24:08,27) [ata_sff/0]
(root,0,0,00:00:00/1521-21:24:08,28) [ata_sff/1]
(root,0,0,00:00:00/1521-21:24:08,29) [ksuspend_usbd]
(root,0,0,00:00:00/1521-21:24:08,30) [khubd]
(root,0,0,00:00:00/1521-21:24:08,31) [kseriod]
(root,0,0,00:00:00/1521-21:24:08,32) [md/0]
(root,0,0,00:00:00/1521-21:24:08,33) [md/1]
(root,0,0,00:00:00/1521-21:24:08,34) [md_misc/0]
(root,0,0,00:00:00/1521-21:24:08,35) [md_misc/1]
(root,0,0,00:00:00/1521-21:24:08,36) [linkwatch]
(root,0,0,00:00:49/1521-21:24:08,37) [khungtaskd]
(root,0,0,00:00:07/1521-21:24:08,38) [kswapd0]
(root,0,0,00:00:00/1521-21:24:08,39) [ksmd]
(root,0,0,00:00:00/1521-21:24:08,40) [aio/0]
(root,0,0,00:00:00/1521-21:24:08,41) [aio/1]
(root,0,0,00:00:00/1521-21:24:08,42) [crypto/0]
(root,0,0,00:00:00/1521-21:24:08,43) [crypto/1]
(root,0,0,00:00:00/1521-21:24:08,51) [kthrotld/0]
(root,0,0,00:00:00/1521-21:24:08,52) [kthrotld/1]
(root,0,0,00:00:00/1521-21:24:08,54) [khvcd]
(root,0,0,00:00:00/1521-21:24:08,55) [kpsmoused]
(root,0,0,00:00:00/1521-21:24:08,56) [usbhid_resumer]
(root,0,0,00:00:00/1521-21:24:08,57) [deferwq]
(root,0,0,00:00:00/1521-21:24:08,89) [kdmremove]
(root,0,0,00:00:00/1521-21:24:08,90) [kstriped]
(root,0,0,00:00:00/1521-21:24:03,233) [kdmflush]
(root,0,0,00:00:00/1521-21:24:03,235) [kdmflush]
(root,0,0,00:00:28/1521-21:23:50,252) [kjournald]
(root,10936,368,00:00:00/1521-21:23:30,341) /sbin/udevd -d
(root,0,0,00:00:00/1521-21:23:15,610) [kdmflush]
(root,0,0,00:00:00/1521-21:23:15,613) [kdmflush]
(root,0,0,00:00:00/1521-21:23:15,616) [kdmflush]
(root,0,0,00:00:00/1521-21:23:15,621) [kdmflush]
(root,0,0,00:00:00/1521-21:23:15,627) [kdmflush]
(root,10932,472,00:00:00/1521-21:23:15,628) /sbin/udevd -d
(root,0,0,00:00:00/1521-21:23:15,631) [kdmflush]
(root,10932,436,00:00:00/1521-21:23:15,632) /sbin/udevd -d
(root,0,0,00:16:38/1521-21:23:03,702) [flush-253:4]
(root,0,0,00:00:00/1521-21:22:54,706) [kjournald]
(root,0,0,00:00:00/1521-21:22:53,709) [xfs_mru_cache]
(root,0,0,00:11:15/1521-21:22:53,710) [xfslogd/0]
(root,0,0,00:00:00/1521-21:22:53,711) [xfslogd/1]
(root,0,0,00:15:28/1521-21:22:53,712) [xfsdatad/0]
(root,0,0,00:00:00/1521-21:22:53,713) [xfsdatad/1]
(root,0,0,00:00:00/1521-21:22:53,714) [xfsconvertd/0]
(root,0,0,00:00:00/1521-21:22:53,715) [xfsconvertd/1]
(root,0,0,00:00:12/1521-21:22:53,716) [xfsalloc/0]
(root,0,0,00:00:35/1521-21:22:53,717) [xfsalloc/1]
(root,0,0,00:00:12/1521-21:22:53,718) [xfseofblocks/0]
(root,0,0,00:00:45/1521-21:22:53,719) [xfseofblocks/1]
(root,0,0,00:00:00/1521-21:22:53,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1521-21:22:53,721) [xfs-cil/dm-3]
(root,0,0,00:01:46/1521-21:22:53,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1521-21:22:52,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1521-21:22:50,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1521-21:22:50,725) [xfs-cil/dm-2]
(root,0,0,00:01:48/1521-21:22:50,726) [xfssyncd/dm-2]
(root,0,0,08:06:29/1521-21:22:49,727) [xfsaild/dm-2]
(root,0,0,00:17:07/1521-21:22:22,728) [kjournald]
(root,0,0,00:07:30/1521-21:22:21,729) [xfsbufd/dm-5]
(root,0,0,00:06:11/1521-21:22:21,730) [xfs-cil/dm-5]
(root,0,0,00:07:09/1521-21:22:21,731) [xfssyncd/dm-5]
(root,0,0,10:56:11/1521-21:22:21,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1521-21:22:19,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1521-21:22:19,734) [xfs-cil/dm-7]
(root,0,0,00:01:46/1521-21:22:19,735) [xfssyncd/dm-7]
(root,0,0,08:09:05/1521-21:22:19,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1521-21:22:17,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1521-21:22:17,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1521-21:22:17,739) [xfssyncd/dm-6]
(root,0,0,08:09:29/1521-21:22:17,740) [xfsaild/dm-6]
(root,0,0,01:11:24/1521-21:21:58,816) [kauditd]
(apache,597260,195240,00:00:00/2-06:37:48,846) /usr/sbin/httpd
(apache,597264,195284,00:00:00/2-06:37:47,850) /usr/sbin/httpd
(apache,597264,195316,00:00:00/2-06:37:47,851) /usr/sbin/httpd
(apache,597264,195272,00:00:00/2-06:37:46,853) /usr/sbin/httpd
(apache,597264,195256,00:00:00/2-06:37:45,854) /usr/sbin/httpd
(apache,597264,195272,00:00:00/2-06:37:45,855) /usr/sbin/httpd
(apache,597264,195264,00:00:00/2-06:37:45,856) /usr/sbin/httpd
(root,93156,740,04:57:54/1521-21:21:44,1154) auditd
(root,249864,5540,02:47:09/1521-21:21:43,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,1000,00:06:51/1521-21:21:42,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1521-21:21:41,1215) rpc.statd
(dbus,21580,1000,00:00:07/1521-21:21:39,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1521-21:21:37,1285) hald
(root,20400,836,00:00:00/1521-21:21:37,1286) hald-runner
(root,0,0,00:00:00/07:35:10,1321) [flush-253:5]
(root,452700,1136,00:36:30/1521-21:21:31,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:18:36/1521-21:21:26,1375) /usr/sbin/sshd
(root,21716,804,00:24:50/1521-21:21:25,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:30:40/1521-21:21:21,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:37/1521-21:21:13,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1521-21:21:12,1555) qmgr -l -t fifo -u
(rabbitmq,10952,620,00:24:39/1521-21:21:02,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1521-21:21:00,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1521-21:21:00,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1521-21:21:00,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1441612,191916,9-12:42:05/1521-21:21:00,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:38/1521-21:20:40,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:48/1521-21:20:40,1759) inet_gethost 4
(root,112532,776,00:00:01/1521-21:20:39,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,595524,201328,01:30:59/1521-21:20:34,1776) /usr/sbin/httpd
(root,116864,704,00:13:10/1521-21:20:33,1786) crond
(root,21104,316,00:00:01/1521-21:20:33,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1521-21:20:33,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1521-21:20:33,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1521-21:20:33,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1521-21:20:33,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1521-21:20:33,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1521-21:20:33,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1521-21:20:33,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,597272,195288,00:00:00/2-14:37:11,2290) /usr/sbin/httpd
(apache,597272,195340,00:00:00/2-14:37:08,2292) /usr/sbin/httpd
(apache,597272,195236,00:00:00/2-14:37:07,2295) /usr/sbin/httpd
(apache,597264,195276,00:00:00/2-14:37:07,2296) /usr/sbin/httpd
(apache,597272,195248,00:00:00/2-14:36:19,2321) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/35:57,16577) pickup -l -t fifo -u
(apache,595524,190984,00:00:00/3-12:19:45,19464) /usr/sbin/httpd
(apache,597272,195320,00:00:00/3-12:19:45,19475) /usr/sbin/httpd
(apache,597272,195380,00:00:00/3-12:19:45,19485) /usr/sbin/httpd
(apache,597272,195340,00:00:00/3-12:19:44,19494) /usr/sbin/httpd
(apache,597272,195320,00:00:00/3-12:19:44,19504) /usr/sbin/httpd
(apache,597272,195356,00:00:00/3-12:19:44,19515) /usr/sbin/httpd
(apache,597272,195308,00:00:00/3-12:19:44,19524) /usr/sbin/httpd
(apache,597272,195332,00:00:00/3-12:19:44,19533) /usr/sbin/httpd
(apache,597272,195316,00:00:00/3-12:19:44,19543) /usr/sbin/httpd
(root,0,0,00:00:00/00:05,20577) [flush-253:1]
(root,110268,1488,00:00:00/00:00,20651) /bin/bash /usr/bin/check_mk_agent
(root,13368,968,00:00:00/00:00,20669) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,20670) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/719-05:33:18,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/719-05:33:18,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/719-05:33:18,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15372,2-13:25:22/719-05:33:18,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-08-07 20:01

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939e1514c51

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:17/1519-22:08:56,1) /sbin/init
(root,0,0,00:00:05/1519-22:08:56,2) [kthreadd]
(root,0,0,00:14:03/1519-22:08:56,3) [migration/0]
(root,0,0,00:12:15/1519-22:08:56,4) [ksoftirqd/0]
(root,0,0,00:00:00/1519-22:08:56,5) [stopper/0]
(root,0,0,00:03:58/1519-22:08:56,6) [watchdog/0]
(root,0,0,00:20:44/1519-22:08:56,7) [migration/1]
(root,0,0,00:00:00/1519-22:08:56,8) [stopper/1]
(root,0,0,00:07:03/1519-22:08:56,9) [ksoftirqd/1]
(root,0,0,00:03:42/1519-22:08:56,10) [watchdog/1]
(root,0,0,02:42:25/1519-22:08:56,11) [events/0]
(root,0,0,02:52:56/1519-22:08:56,12) [events/1]
(root,0,0,00:00:00/1519-22:08:56,13) [cgroup]
(root,0,0,00:00:00/1519-22:08:56,14) [khelper]
(root,0,0,00:00:00/1519-22:08:56,15) [netns]
(root,0,0,00:00:00/1519-22:08:56,16) [async/mgr]
(root,0,0,00:00:00/1519-22:08:56,17) [pm]
(root,0,0,00:00:00/1519-22:08:56,18) [xenwatch]
(root,0,0,00:00:00/1519-22:08:56,19) [xenbus]
(root,0,0,00:08:40/1519-22:08:56,20) [sync_supers]
(root,0,0,00:10:17/1519-22:08:56,21) [bdi-default]
(root,0,0,00:00:00/1519-22:08:56,22) [kintegrityd/0]
(root,0,0,00:00:00/1519-22:08:56,23) [kintegrityd/1]
(root,0,0,00:09:00/1519-22:08:56,24) [kblockd/0]
(root,0,0,00:01:43/1519-22:08:56,25) [kblockd/1]
(root,0,0,00:00:00/1519-22:08:56,26) [ata_aux]
(root,0,0,00:00:00/1519-22:08:56,27) [ata_sff/0]
(root,0,0,00:00:00/1519-22:08:56,28) [ata_sff/1]
(root,0,0,00:00:00/1519-22:08:56,29) [ksuspend_usbd]
(root,0,0,00:00:00/1519-22:08:56,30) [khubd]
(root,0,0,00:00:00/1519-22:08:56,31) [kseriod]
(root,0,0,00:00:00/1519-22:08:56,32) [md/0]
(root,0,0,00:00:00/1519-22:08:56,33) [md/1]
(root,0,0,00:00:00/1519-22:08:56,34) [md_misc/0]
(root,0,0,00:00:00/1519-22:08:56,35) [md_misc/1]
(root,0,0,00:00:00/1519-22:08:56,36) [linkwatch]
(root,0,0,00:00:49/1519-22:08:56,37) [khungtaskd]
(root,0,0,00:00:07/1519-22:08:56,38) [kswapd0]
(root,0,0,00:00:00/1519-22:08:56,39) [ksmd]
(root,0,0,00:00:00/1519-22:08:56,40) [aio/0]
(root,0,0,00:00:00/1519-22:08:56,41) [aio/1]
(root,0,0,00:00:00/1519-22:08:56,42) [crypto/0]
(root,0,0,00:00:00/1519-22:08:56,43) [crypto/1]
(root,0,0,00:00:00/1519-22:08:56,51) [kthrotld/0]
(root,0,0,00:00:00/1519-22:08:56,52) [kthrotld/1]
(root,0,0,00:00:00/1519-22:08:56,54) [khvcd]
(root,0,0,00:00:00/1519-22:08:56,55) [kpsmoused]
(root,0,0,00:00:00/1519-22:08:56,56) [usbhid_resumer]
(root,0,0,00:00:00/1519-22:08:56,57) [deferwq]
(root,0,0,00:00:00/1519-22:08:56,89) [kdmremove]
(root,0,0,00:00:00/1519-22:08:56,90) [kstriped]
(root,0,0,00:00:00/1519-22:08:51,233) [kdmflush]
(root,0,0,00:00:00/1519-22:08:51,235) [kdmflush]
(root,0,0,00:00:28/1519-22:08:38,252) [kjournald]
(root,10936,368,00:00:00/1519-22:08:18,341) /sbin/udevd -d
(root,0,0,00:00:00/1519-22:08:03,610) [kdmflush]
(root,0,0,00:00:00/1519-22:08:03,613) [kdmflush]
(root,0,0,00:00:00/1519-22:08:03,616) [kdmflush]
(root,0,0,00:00:00/1519-22:08:03,621) [kdmflush]
(root,0,0,00:00:00/1519-22:08:03,627) [kdmflush]
(root,10932,472,00:00:00/1519-22:08:03,628) /sbin/udevd -d
(root,0,0,00:00:00/1519-22:08:03,631) [kdmflush]
(root,10932,436,00:00:00/1519-22:08:03,632) /sbin/udevd -d
(root,0,0,00:16:36/1519-22:07:51,702) [flush-253:4]
(root,0,0,00:00:00/1519-22:07:42,706) [kjournald]
(root,0,0,00:00:00/1519-22:07:41,709) [xfs_mru_cache]
(root,0,0,00:11:14/1519-22:07:41,710) [xfslogd/0]
(root,0,0,00:00:00/1519-22:07:41,711) [xfslogd/1]
(root,0,0,00:15:27/1519-22:07:41,712) [xfsdatad/0]
(root,0,0,00:00:00/1519-22:07:41,713) [xfsdatad/1]
(root,0,0,00:00:00/1519-22:07:41,714) [xfsconvertd/0]
(root,0,0,00:00:00/1519-22:07:41,715) [xfsconvertd/1]
(root,0,0,00:00:12/1519-22:07:41,716) [xfsalloc/0]
(root,0,0,00:00:35/1519-22:07:41,717) [xfsalloc/1]
(root,0,0,00:00:12/1519-22:07:41,718) [xfseofblocks/0]
(root,0,0,00:00:45/1519-22:07:41,719) [xfseofblocks/1]
(root,0,0,00:00:00/1519-22:07:41,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1519-22:07:41,721) [xfs-cil/dm-3]
(root,0,0,00:01:46/1519-22:07:41,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1519-22:07:40,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1519-22:07:38,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1519-22:07:38,725) [xfs-cil/dm-2]
(root,0,0,00:01:48/1519-22:07:38,726) [xfssyncd/dm-2]
(root,0,0,08:05:49/1519-22:07:37,727) [xfsaild/dm-2]
(root,0,0,00:17:05/1519-22:07:10,728) [kjournald]
(root,0,0,00:07:30/1519-22:07:09,729) [xfsbufd/dm-5]
(root,0,0,00:06:11/1519-22:07:09,730) [xfs-cil/dm-5]
(root,0,0,00:07:09/1519-22:07:09,731) [xfssyncd/dm-5]
(root,0,0,10:55:19/1519-22:07:09,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1519-22:07:07,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1519-22:07:07,734) [xfs-cil/dm-7]
(root,0,0,00:01:46/1519-22:07:07,735) [xfssyncd/dm-7]
(root,0,0,08:08:26/1519-22:07:07,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1519-22:07:05,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1519-22:07:05,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1519-22:07:05,739) [xfssyncd/dm-6]
(root,0,0,08:08:51/1519-22:07:05,740) [xfsaild/dm-6]
(root,0,0,01:11:19/1519-22:06:46,816) [kauditd]
(apache,597260,194992,00:00:00/07:22:36,846) /usr/sbin/httpd
(apache,597264,194208,00:00:00/07:22:35,850) /usr/sbin/httpd
(apache,597264,194988,00:00:00/07:22:35,851) /usr/sbin/httpd
(apache,597264,195064,00:00:00/07:22:34,853) /usr/sbin/httpd
(apache,597264,194204,00:00:00/07:22:33,854) /usr/sbin/httpd
(apache,597264,194208,00:00:00/07:22:33,855) /usr/sbin/httpd
(apache,597264,194208,00:00:00/07:22:33,856) /usr/sbin/httpd
(root,93156,740,04:57:36/1519-22:06:32,1154) auditd
(root,249864,5540,02:46:58/1519-22:06:31,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:50/1519-22:06:30,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1519-22:06:29,1215) rpc.statd
(dbus,21580,1000,00:00:07/1519-22:06:27,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1519-22:06:25,1285) hald
(root,20400,836,00:00:00/1519-22:06:25,1286) hald-runner
(root,452700,1136,00:36:26/1519-22:06:19,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:18:15/1519-22:06:14,1375) /usr/sbin/sshd
(root,21716,804,00:24:48/1519-22:06:13,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:30:37/1519-22:06:09,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:36/1519-22:06:01,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1519-22:06:00,1555) qmgr -l -t fifo -u
(rabbitmq,10952,620,00:24:37/1519-22:05:50,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1519-22:05:48,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1519-22:05:48,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1519-22:05:48,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1446652,196764,9-12:23:16/1519-22:05:48,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:38/1519-22:05:28,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:48/1519-22:05:28,1759) inet_gethost 4
(root,112532,776,00:00:01/1519-22:05:27,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,595524,201328,01:30:52/1519-22:05:22,1776) /usr/sbin/httpd
(root,116864,704,00:13:09/1519-22:05:21,1786) crond
(root,21104,316,00:00:01/1519-22:05:21,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1519-22:05:21,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1519-22:05:21,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1519-22:05:21,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1519-22:05:21,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1519-22:05:21,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1519-22:05:21,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1519-22:05:21,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,597272,195176,00:00:00/15:21:59,2290) /usr/sbin/httpd
(apache,597272,195200,00:00:00/15:21:56,2292) /usr/sbin/httpd
(apache,597272,195116,00:00:00/15:21:55,2295) /usr/sbin/httpd
(apache,597264,195196,00:00:00/15:21:55,2296) /usr/sbin/httpd
(apache,597272,195180,00:00:00/15:21:07,2321) /usr/sbin/httpd
(apache,595524,190984,00:00:00/1-13:04:33,19464) /usr/sbin/httpd
(apache,597272,195284,00:00:00/1-13:04:33,19475) /usr/sbin/httpd
(apache,597272,195340,00:00:00/1-13:04:33,19485) /usr/sbin/httpd
(apache,597272,195300,00:00:00/1-13:04:32,19494) /usr/sbin/httpd
(apache,597272,195272,00:00:00/1-13:04:32,19504) /usr/sbin/httpd
(apache,597272,195284,00:00:00/1-13:04:32,19515) /usr/sbin/httpd
(apache,597272,195284,00:00:00/1-13:04:32,19524) /usr/sbin/httpd
(apache,597272,195324,00:00:00/1-13:04:32,19533) /usr/sbin/httpd
(apache,597272,195264,00:00:00/1-13:04:32,19543) /usr/sbin/httpd
(root,0,0,00:00:02/2-09:55:54,20450) [flush-253:5]
(root,108468,1060,00:00:00/717-06:18:06,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/717-06:18:06,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/717-06:18:06,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14984,2-13:20:26/717-06:18:06,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/03:09,29096) pickup -l -t fifo -u
(root,67568,3164,00:00:00/00:03,29485) sshd: [accepted] 
(sshd,67568,1392,00:00:00/00:01,29486) sshd: [net]      
(root,110268,1484,00:00:00/00:01,29502) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,29523) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:00,29524) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-08-05 20:45

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79398a63a05a

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:14/1518-04:36:53,1) /sbin/init
(root,0,0,00:00:05/1518-04:36:53,2) [kthreadd]
(root,0,0,00:14:02/1518-04:36:53,3) [migration/0]
(root,0,0,00:12:14/1518-04:36:53,4) [ksoftirqd/0]
(root,0,0,00:00:00/1518-04:36:53,5) [stopper/0]
(root,0,0,00:03:57/1518-04:36:53,6) [watchdog/0]
(root,0,0,00:20:43/1518-04:36:53,7) [migration/1]
(root,0,0,00:00:00/1518-04:36:53,8) [stopper/1]
(root,0,0,00:07:02/1518-04:36:53,9) [ksoftirqd/1]
(root,0,0,00:03:42/1518-04:36:53,10) [watchdog/1]
(root,0,0,02:42:13/1518-04:36:53,11) [events/0]
(root,0,0,02:52:43/1518-04:36:53,12) [events/1]
(root,0,0,00:00:00/1518-04:36:53,13) [cgroup]
(root,0,0,00:00:00/1518-04:36:53,14) [khelper]
(root,0,0,00:00:00/1518-04:36:53,15) [netns]
(root,0,0,00:00:00/1518-04:36:53,16) [async/mgr]
(root,0,0,00:00:00/1518-04:36:53,17) [pm]
(root,0,0,00:00:00/1518-04:36:53,18) [xenwatch]
(root,0,0,00:00:00/1518-04:36:53,19) [xenbus]
(root,0,0,00:08:39/1518-04:36:53,20) [sync_supers]
(root,0,0,00:10:17/1518-04:36:53,21) [bdi-default]
(root,0,0,00:00:00/1518-04:36:53,22) [kintegrityd/0]
(root,0,0,00:00:00/1518-04:36:53,23) [kintegrityd/1]
(root,0,0,00:09:00/1518-04:36:53,24) [kblockd/0]
(root,0,0,00:01:43/1518-04:36:53,25) [kblockd/1]
(root,0,0,00:00:00/1518-04:36:53,26) [ata_aux]
(root,0,0,00:00:00/1518-04:36:53,27) [ata_sff/0]
(root,0,0,00:00:00/1518-04:36:53,28) [ata_sff/1]
(root,0,0,00:00:00/1518-04:36:53,29) [ksuspend_usbd]
(root,0,0,00:00:00/1518-04:36:53,30) [khubd]
(root,0,0,00:00:00/1518-04:36:53,31) [kseriod]
(root,0,0,00:00:00/1518-04:36:53,32) [md/0]
(root,0,0,00:00:00/1518-04:36:53,33) [md/1]
(root,0,0,00:00:00/1518-04:36:53,34) [md_misc/0]
(root,0,0,00:00:00/1518-04:36:53,35) [md_misc/1]
(root,0,0,00:00:00/1518-04:36:53,36) [linkwatch]
(root,0,0,00:00:49/1518-04:36:53,37) [khungtaskd]
(root,0,0,00:00:07/1518-04:36:53,38) [kswapd0]
(root,0,0,00:00:00/1518-04:36:53,39) [ksmd]
(root,0,0,00:00:00/1518-04:36:53,40) [aio/0]
(root,0,0,00:00:00/1518-04:36:53,41) [aio/1]
(root,0,0,00:00:00/1518-04:36:53,42) [crypto/0]
(root,0,0,00:00:00/1518-04:36:53,43) [crypto/1]
(root,0,0,00:00:00/1518-04:36:53,51) [kthrotld/0]
(root,0,0,00:00:00/1518-04:36:53,52) [kthrotld/1]
(root,0,0,00:00:00/1518-04:36:53,54) [khvcd]
(root,0,0,00:00:00/1518-04:36:53,55) [kpsmoused]
(root,0,0,00:00:00/1518-04:36:53,56) [usbhid_resumer]
(root,0,0,00:00:00/1518-04:36:53,57) [deferwq]
(root,0,0,00:00:00/1518-04:36:53,89) [kdmremove]
(root,0,0,00:00:00/1518-04:36:53,90) [kstriped]
(root,0,0,00:00:00/1518-04:36:48,233) [kdmflush]
(root,0,0,00:00:00/1518-04:36:48,235) [kdmflush]
(root,0,0,00:00:27/1518-04:36:35,252) [kjournald]
(root,10936,368,00:00:00/1518-04:36:15,341) /sbin/udevd -d
(root,0,0,00:00:00/1518-04:36:00,610) [kdmflush]
(root,0,0,00:00:00/1518-04:36:00,613) [kdmflush]
(root,0,0,00:00:00/1518-04:36:00,616) [kdmflush]
(root,0,0,00:00:00/1518-04:36:00,621) [kdmflush]
(root,0,0,00:00:00/1518-04:36:00,627) [kdmflush]
(root,10932,472,00:00:00/1518-04:36:00,628) /sbin/udevd -d
(root,0,0,00:00:00/1518-04:36:00,631) [kdmflush]
(root,10932,436,00:00:00/1518-04:36:00,632) /sbin/udevd -d
(root,0,0,00:16:34/1518-04:35:48,702) [flush-253:4]
(root,0,0,00:00:00/1518-04:35:39,706) [kjournald]
(root,0,0,00:00:00/1518-04:35:38,709) [xfs_mru_cache]
(root,0,0,00:11:13/1518-04:35:38,710) [xfslogd/0]
(root,0,0,00:00:00/1518-04:35:38,711) [xfslogd/1]
(root,0,0,00:15:26/1518-04:35:38,712) [xfsdatad/0]
(root,0,0,00:00:00/1518-04:35:38,713) [xfsdatad/1]
(root,0,0,00:00:00/1518-04:35:38,714) [xfsconvertd/0]
(root,0,0,00:00:00/1518-04:35:38,715) [xfsconvertd/1]
(root,0,0,00:00:12/1518-04:35:38,716) [xfsalloc/0]
(root,0,0,00:00:35/1518-04:35:38,717) [xfsalloc/1]
(root,0,0,00:00:12/1518-04:35:38,718) [xfseofblocks/0]
(root,0,0,00:00:45/1518-04:35:38,719) [xfseofblocks/1]
(root,0,0,00:00:00/1518-04:35:38,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1518-04:35:38,721) [xfs-cil/dm-3]
(root,0,0,00:01:46/1518-04:35:38,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1518-04:35:37,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1518-04:35:35,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1518-04:35:35,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1518-04:35:35,726) [xfssyncd/dm-2]
(root,0,0,08:05:15/1518-04:35:34,727) [xfsaild/dm-2]
(root,0,0,00:17:04/1518-04:35:07,728) [kjournald]
(root,0,0,00:07:29/1518-04:35:06,729) [xfsbufd/dm-5]
(root,0,0,00:06:10/1518-04:35:06,730) [xfs-cil/dm-5]
(root,0,0,00:07:08/1518-04:35:06,731) [xfssyncd/dm-5]
(root,0,0,10:54:32/1518-04:35:06,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1518-04:35:04,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1518-04:35:04,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1518-04:35:04,735) [xfssyncd/dm-7]
(root,0,0,08:07:52/1518-04:35:04,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1518-04:35:02,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1518-04:35:02,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1518-04:35:02,739) [xfssyncd/dm-6]
(root,0,0,08:08:17/1518-04:35:02,740) [xfsaild/dm-6]
(root,0,0,01:11:13/1518-04:34:43,816) [kauditd]
(root,93156,740,04:57:08/1518-04:34:29,1154) auditd
(root,249864,5540,02:46:43/1518-04:34:28,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:50/1518-04:34:27,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1518-04:34:26,1215) rpc.statd
(dbus,21580,1000,00:00:07/1518-04:34:24,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1518-04:34:22,1285) hald
(root,20400,836,00:00:00/1518-04:34:22,1286) hald-runner
(root,452700,1136,00:36:24/1518-04:34:16,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:17:41/1518-04:34:11,1375) /usr/sbin/sshd
(root,21716,804,00:24:46/1518-04:34:10,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1468,00:30:35/1518-04:34:06,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:35/1518-04:33:58,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1518-04:33:57,1555) qmgr -l -t fifo -u
(rabbitmq,10952,620,00:24:36/1518-04:33:47,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1518-04:33:45,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1518-04:33:45,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1518-04:33:45,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1440964,192016,9-12:06:25/1518-04:33:45,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:38/1518-04:33:25,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:47/1518-04:33:25,1759) inet_gethost 4
(root,112532,776,00:00:01/1518-04:33:24,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,594732,200480,01:30:42/1518-04:33:19,1776) /usr/sbin/httpd
(root,116864,704,00:13:08/1518-04:33:18,1786) crond
(root,21104,316,00:00:01/1518-04:33:18,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1518-04:33:18,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1518-04:33:18,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1518-04:33:18,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1518-04:33:18,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1518-04:33:18,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1518-04:33:18,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1518-04:33:18,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,596416,194536,00:00:00/6-11:31:56,2718) /usr/sbin/httpd
(apache,596416,194516,00:00:00/4-20:19:56,7252) /usr/sbin/httpd
(apache,596412,194444,00:00:00/4-20:19:55,7254) /usr/sbin/httpd
(apache,596416,194480,00:00:00/4-20:19:55,7255) /usr/sbin/httpd
(apache,596416,194456,00:00:00/4-20:19:54,7256) /usr/sbin/httpd
(apache,596416,194528,00:00:00/4-20:19:54,7257) /usr/sbin/httpd
(apache,596416,194508,00:00:00/4-20:19:53,7258) /usr/sbin/httpd
(apache,596416,194480,00:00:00/4-20:19:53,7259) /usr/sbin/httpd
(postfix,80944,3368,00:00:00/13:15,16501) pickup -l -t fifo -u
(root,67568,3248,00:00:00/00:06,18148) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:05,18244) sshd: [net]      
(root,110268,1488,00:00:00/00:01,18327) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,18345) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,18346) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,594732,190136,00:00:00/6-19:51:34,19819) /usr/sbin/httpd
(apache,596416,194568,00:00:00/6-19:51:34,19820) /usr/sbin/httpd
(apache,596416,194496,00:00:00/6-19:51:34,19827) /usr/sbin/httpd
(apache,596416,194540,00:00:00/6-19:51:34,19836) /usr/sbin/httpd
(apache,596416,194532,00:00:00/6-19:51:34,19845) /usr/sbin/httpd
(apache,596416,194532,00:00:00/6-19:51:34,19852) /usr/sbin/httpd
(apache,596416,194536,00:00:00/6-19:51:34,19862) /usr/sbin/httpd
(apache,596416,194528,00:00:00/6-19:51:34,19871) /usr/sbin/httpd
(apache,596416,194528,00:00:00/6-19:51:34,19880) /usr/sbin/httpd
(root,0,0,00:00:00/16:23:51,20450) [flush-253:5]
(root,108468,1060,00:00:00/715-12:46:03,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/715-12:46:03,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/715-12:46:03,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14920,2-13:14:17/715-12:46:03,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,596424,194496,00:00:00/5-00:48:15,30195) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-08-04 03:13

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939d242900e

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:12/1516-02:24:07,1) /sbin/init
(root,0,0,00:00:05/1516-02:24:07,2) [kthreadd]
(root,0,0,00:14:00/1516-02:24:07,3) [migration/0]
(root,0,0,00:12:13/1516-02:24:07,4) [ksoftirqd/0]
(root,0,0,00:00:00/1516-02:24:07,5) [stopper/0]
(root,0,0,00:03:57/1516-02:24:07,6) [watchdog/0]
(root,0,0,00:20:41/1516-02:24:07,7) [migration/1]
(root,0,0,00:00:00/1516-02:24:07,8) [stopper/1]
(root,0,0,00:07:01/1516-02:24:07,9) [ksoftirqd/1]
(root,0,0,00:03:42/1516-02:24:07,10) [watchdog/1]
(root,0,0,02:41:58/1516-02:24:07,11) [events/0]
(root,0,0,02:52:28/1516-02:24:07,12) [events/1]
(root,0,0,00:00:00/1516-02:24:07,13) [cgroup]
(root,0,0,00:00:00/1516-02:24:07,14) [khelper]
(root,0,0,00:00:00/1516-02:24:07,15) [netns]
(root,0,0,00:00:00/1516-02:24:07,16) [async/mgr]
(root,0,0,00:00:00/1516-02:24:07,17) [pm]
(root,0,0,00:00:00/1516-02:24:07,18) [xenwatch]
(root,0,0,00:00:00/1516-02:24:07,19) [xenbus]
(root,0,0,00:08:39/1516-02:24:07,20) [sync_supers]
(root,0,0,00:10:16/1516-02:24:07,21) [bdi-default]
(root,0,0,00:00:00/1516-02:24:07,22) [kintegrityd/0]
(root,0,0,00:00:00/1516-02:24:07,23) [kintegrityd/1]
(root,0,0,00:08:59/1516-02:24:07,24) [kblockd/0]
(root,0,0,00:01:43/1516-02:24:07,25) [kblockd/1]
(root,0,0,00:00:00/1516-02:24:07,26) [ata_aux]
(root,0,0,00:00:00/1516-02:24:07,27) [ata_sff/0]
(root,0,0,00:00:00/1516-02:24:07,28) [ata_sff/1]
(root,0,0,00:00:00/1516-02:24:07,29) [ksuspend_usbd]
(root,0,0,00:00:00/1516-02:24:07,30) [khubd]
(root,0,0,00:00:00/1516-02:24:07,31) [kseriod]
(root,0,0,00:00:00/1516-02:24:07,32) [md/0]
(root,0,0,00:00:00/1516-02:24:07,33) [md/1]
(root,0,0,00:00:00/1516-02:24:07,34) [md_misc/0]
(root,0,0,00:00:00/1516-02:24:07,35) [md_misc/1]
(root,0,0,00:00:00/1516-02:24:07,36) [linkwatch]
(root,0,0,00:00:49/1516-02:24:07,37) [khungtaskd]
(root,0,0,00:00:07/1516-02:24:07,38) [kswapd0]
(root,0,0,00:00:00/1516-02:24:07,39) [ksmd]
(root,0,0,00:00:00/1516-02:24:07,40) [aio/0]
(root,0,0,00:00:00/1516-02:24:07,41) [aio/1]
(root,0,0,00:00:00/1516-02:24:07,42) [crypto/0]
(root,0,0,00:00:00/1516-02:24:07,43) [crypto/1]
(root,0,0,00:00:00/1516-02:24:07,51) [kthrotld/0]
(root,0,0,00:00:00/1516-02:24:07,52) [kthrotld/1]
(root,0,0,00:00:00/1516-02:24:07,54) [khvcd]
(root,0,0,00:00:00/1516-02:24:07,55) [kpsmoused]
(root,0,0,00:00:00/1516-02:24:07,56) [usbhid_resumer]
(root,0,0,00:00:00/1516-02:24:07,57) [deferwq]
(root,0,0,00:00:00/1516-02:24:07,89) [kdmremove]
(root,0,0,00:00:00/1516-02:24:07,90) [kstriped]
(root,0,0,00:00:00/1516-02:24:02,233) [kdmflush]
(root,0,0,00:00:00/1516-02:24:02,235) [kdmflush]
(root,0,0,00:00:27/1516-02:23:49,252) [kjournald]
(root,10936,368,00:00:00/1516-02:23:29,341) /sbin/udevd -d
(root,0,0,00:00:00/1516-02:23:14,610) [kdmflush]
(root,0,0,00:00:00/1516-02:23:14,613) [kdmflush]
(root,0,0,00:00:00/1516-02:23:14,616) [kdmflush]
(root,0,0,00:00:00/1516-02:23:14,621) [kdmflush]
(root,0,0,00:00:00/1516-02:23:14,627) [kdmflush]
(root,10932,472,00:00:00/1516-02:23:14,628) /sbin/udevd -d
(root,0,0,00:00:00/1516-02:23:14,631) [kdmflush]
(root,10932,436,00:00:00/1516-02:23:14,632) /sbin/udevd -d
(root,0,0,00:16:33/1516-02:23:02,702) [flush-253:4]
(root,0,0,00:00:00/1516-02:22:53,706) [kjournald]
(root,0,0,00:00:00/1516-02:22:52,709) [xfs_mru_cache]
(root,0,0,00:11:12/1516-02:22:52,710) [xfslogd/0]
(root,0,0,00:00:00/1516-02:22:52,711) [xfslogd/1]
(root,0,0,00:15:24/1516-02:22:52,712) [xfsdatad/0]
(root,0,0,00:00:00/1516-02:22:52,713) [xfsdatad/1]
(root,0,0,00:00:00/1516-02:22:52,714) [xfsconvertd/0]
(root,0,0,00:00:00/1516-02:22:52,715) [xfsconvertd/1]
(root,0,0,00:00:12/1516-02:22:52,716) [xfsalloc/0]
(root,0,0,00:00:35/1516-02:22:52,717) [xfsalloc/1]
(root,0,0,00:00:12/1516-02:22:52,718) [xfseofblocks/0]
(root,0,0,00:00:45/1516-02:22:52,719) [xfseofblocks/1]
(root,0,0,00:00:00/1516-02:22:52,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1516-02:22:52,721) [xfs-cil/dm-3]
(root,0,0,00:01:46/1516-02:22:52,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1516-02:22:51,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1516-02:22:49,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1516-02:22:49,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1516-02:22:49,726) [xfssyncd/dm-2]
(root,0,0,08:04:34/1516-02:22:48,727) [xfsaild/dm-2]
(root,0,0,00:17:03/1516-02:22:21,728) [kjournald]
(root,0,0,00:07:29/1516-02:22:20,729) [xfsbufd/dm-5]
(root,0,0,00:06:10/1516-02:22:20,730) [xfs-cil/dm-5]
(root,0,0,00:07:07/1516-02:22:20,731) [xfssyncd/dm-5]
(root,0,0,10:53:37/1516-02:22:20,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1516-02:22:18,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1516-02:22:18,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1516-02:22:18,735) [xfssyncd/dm-7]
(root,0,0,08:07:08/1516-02:22:18,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1516-02:22:16,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1516-02:22:16,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1516-02:22:16,739) [xfssyncd/dm-6]
(root,0,0,08:07:32/1516-02:22:16,740) [xfsaild/dm-6]
(root,0,0,01:11:08/1516-02:21:57,816) [kauditd]
(root,93156,740,04:56:48/1516-02:21:43,1154) auditd
(root,249864,5540,02:46:32/1516-02:21:42,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:50/1516-02:21:41,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1516-02:21:40,1215) rpc.statd
(dbus,21580,1000,00:00:07/1516-02:21:38,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1516-02:21:36,1285) hald
(root,20400,836,00:00:00/1516-02:21:36,1286) hald-runner
(root,452700,1136,00:36:21/1516-02:21:30,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:17:15/1516-02:21:25,1375) /usr/sbin/sshd
(root,21716,804,00:24:44/1516-02:21:24,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:33/1516-02:21:20,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:34/1516-02:21:12,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1516-02:21:11,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:34/1516-02:21:01,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1516-02:20:59,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1516-02:20:59,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1516-02:20:59,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1439988,191672,9-11:46:39/1516-02:20:59,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:38/1516-02:20:39,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:47/1516-02:20:39,1759) inet_gethost 4
(root,112532,776,00:00:01/1516-02:20:38,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,594732,200480,01:30:34/1516-02:20:33,1776) /usr/sbin/httpd
(root,116864,704,00:13:07/1516-02:20:32,1786) crond
(root,21104,316,00:00:01/1516-02:20:32,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1516-02:20:32,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1516-02:20:32,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1516-02:20:32,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1516-02:20:32,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1516-02:20:32,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1516-02:20:32,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1516-02:20:32,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,596416,194512,00:00:00/4-09:19:10,2718) /usr/sbin/httpd
(apache,596416,194480,00:00:00/2-18:07:10,7252) /usr/sbin/httpd
(apache,596412,194408,00:00:00/2-18:07:09,7254) /usr/sbin/httpd
(apache,596416,194424,00:00:00/2-18:07:09,7255) /usr/sbin/httpd
(apache,596416,194416,00:00:00/2-18:07:08,7256) /usr/sbin/httpd
(apache,596416,194436,00:00:00/2-18:07:08,7257) /usr/sbin/httpd
(apache,596416,194472,00:00:00/2-18:07:07,7258) /usr/sbin/httpd
(apache,596416,194464,00:00:00/2-18:07:07,7259) /usr/sbin/httpd
(apache,594732,190136,00:00:00/4-17:38:48,19819) /usr/sbin/httpd
(apache,596416,194564,00:00:00/4-17:38:48,19820) /usr/sbin/httpd
(apache,596416,194476,00:00:00/4-17:38:48,19827) /usr/sbin/httpd
(apache,596416,194520,00:00:00/4-17:38:48,19836) /usr/sbin/httpd
(apache,596416,194496,00:00:00/4-17:38:48,19845) /usr/sbin/httpd
(apache,596416,194508,00:00:00/4-17:38:48,19852) /usr/sbin/httpd
(apache,596416,194512,00:00:00/4-17:38:48,19862) /usr/sbin/httpd
(apache,596416,194508,00:00:00/4-17:38:48,19871) /usr/sbin/httpd
(apache,596416,194516,00:00:00/4-17:38:48,19880) /usr/sbin/httpd
(root,108468,1060,00:00:00/713-10:33:17,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/713-10:33:17,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/713-10:33:17,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15716,2-13:05:50/713-10:33:17,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:10/11-07:31:03,23952) [flush-253:5]
(apache,596424,194476,00:00:00/2-22:35:29,30195) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/03:02,30419) pickup -l -t fifo -u
(root,66224,3104,00:00:00/00:35,30701) sshd: [accepted] 
(root,67568,3244,00:00:00/00:04,30825) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:03,30826) sshd: [net]      
(root,110268,1488,00:00:00/00:01,30897) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,30915) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,30916) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-08-02 01:01

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793909227cd2

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:09/1515-00:48:19,1) /sbin/init
(root,0,0,00:00:05/1515-00:48:19,2) [kthreadd]
(root,0,0,00:14:00/1515-00:48:19,3) [migration/0]
(root,0,0,00:12:12/1515-00:48:19,4) [ksoftirqd/0]
(root,0,0,00:00:00/1515-00:48:19,5) [stopper/0]
(root,0,0,00:03:57/1515-00:48:19,6) [watchdog/0]
(root,0,0,00:20:40/1515-00:48:19,7) [migration/1]
(root,0,0,00:00:00/1515-00:48:19,8) [stopper/1]
(root,0,0,00:07:01/1515-00:48:19,9) [ksoftirqd/1]
(root,0,0,00:03:41/1515-00:48:19,10) [watchdog/1]
(root,0,0,02:41:51/1515-00:48:19,11) [events/0]
(root,0,0,02:52:20/1515-00:48:19,12) [events/1]
(root,0,0,00:00:00/1515-00:48:19,13) [cgroup]
(root,0,0,00:00:00/1515-00:48:19,14) [khelper]
(root,0,0,00:00:00/1515-00:48:19,15) [netns]
(root,0,0,00:00:00/1515-00:48:19,16) [async/mgr]
(root,0,0,00:00:00/1515-00:48:19,17) [pm]
(root,0,0,00:00:00/1515-00:48:19,18) [xenwatch]
(root,0,0,00:00:00/1515-00:48:19,19) [xenbus]
(root,0,0,00:08:38/1515-00:48:19,20) [sync_supers]
(root,0,0,00:10:15/1515-00:48:19,21) [bdi-default]
(root,0,0,00:00:00/1515-00:48:19,22) [kintegrityd/0]
(root,0,0,00:00:00/1515-00:48:19,23) [kintegrityd/1]
(root,0,0,00:08:59/1515-00:48:19,24) [kblockd/0]
(root,0,0,00:01:43/1515-00:48:19,25) [kblockd/1]
(root,0,0,00:00:00/1515-00:48:19,26) [ata_aux]
(root,0,0,00:00:00/1515-00:48:19,27) [ata_sff/0]
(root,0,0,00:00:00/1515-00:48:19,28) [ata_sff/1]
(root,0,0,00:00:00/1515-00:48:19,29) [ksuspend_usbd]
(root,0,0,00:00:00/1515-00:48:19,30) [khubd]
(root,0,0,00:00:00/1515-00:48:19,31) [kseriod]
(root,0,0,00:00:00/1515-00:48:19,32) [md/0]
(root,0,0,00:00:00/1515-00:48:19,33) [md/1]
(root,0,0,00:00:00/1515-00:48:19,34) [md_misc/0]
(root,0,0,00:00:00/1515-00:48:19,35) [md_misc/1]
(root,0,0,00:00:00/1515-00:48:19,36) [linkwatch]
(root,0,0,00:00:49/1515-00:48:19,37) [khungtaskd]
(root,0,0,00:00:07/1515-00:48:19,38) [kswapd0]
(root,0,0,00:00:00/1515-00:48:19,39) [ksmd]
(root,0,0,00:00:00/1515-00:48:19,40) [aio/0]
(root,0,0,00:00:00/1515-00:48:19,41) [aio/1]
(root,0,0,00:00:00/1515-00:48:19,42) [crypto/0]
(root,0,0,00:00:00/1515-00:48:19,43) [crypto/1]
(root,0,0,00:00:00/1515-00:48:19,51) [kthrotld/0]
(root,0,0,00:00:00/1515-00:48:19,52) [kthrotld/1]
(root,0,0,00:00:00/1515-00:48:19,54) [khvcd]
(root,0,0,00:00:00/1515-00:48:19,55) [kpsmoused]
(root,0,0,00:00:00/1515-00:48:19,56) [usbhid_resumer]
(root,0,0,00:00:00/1515-00:48:19,57) [deferwq]
(root,0,0,00:00:00/1515-00:48:19,89) [kdmremove]
(root,0,0,00:00:00/1515-00:48:19,90) [kstriped]
(root,0,0,00:00:00/1515-00:48:14,233) [kdmflush]
(root,0,0,00:00:00/1515-00:48:14,235) [kdmflush]
(root,0,0,00:00:27/1515-00:48:01,252) [kjournald]
(root,10936,368,00:00:00/1515-00:47:41,341) /sbin/udevd -d
(root,0,0,00:00:00/1515-00:47:26,610) [kdmflush]
(root,0,0,00:00:00/1515-00:47:26,613) [kdmflush]
(root,0,0,00:00:00/1515-00:47:26,616) [kdmflush]
(root,0,0,00:00:00/1515-00:47:26,621) [kdmflush]
(root,0,0,00:00:00/1515-00:47:26,627) [kdmflush]
(root,10932,472,00:00:00/1515-00:47:26,628) /sbin/udevd -d
(root,0,0,00:00:00/1515-00:47:26,631) [kdmflush]
(root,10932,436,00:00:00/1515-00:47:26,632) /sbin/udevd -d
(root,0,0,00:16:32/1515-00:47:14,702) [flush-253:4]
(root,0,0,00:00:00/1515-00:47:05,706) [kjournald]
(root,0,0,00:00:00/1515-00:47:04,709) [xfs_mru_cache]
(root,0,0,00:11:11/1515-00:47:04,710) [xfslogd/0]
(root,0,0,00:00:00/1515-00:47:04,711) [xfslogd/1]
(root,0,0,00:15:23/1515-00:47:04,712) [xfsdatad/0]
(root,0,0,00:00:00/1515-00:47:04,713) [xfsdatad/1]
(root,0,0,00:00:00/1515-00:47:04,714) [xfsconvertd/0]
(root,0,0,00:00:00/1515-00:47:04,715) [xfsconvertd/1]
(root,0,0,00:00:12/1515-00:47:04,716) [xfsalloc/0]
(root,0,0,00:00:35/1515-00:47:04,717) [xfsalloc/1]
(root,0,0,00:00:12/1515-00:47:04,718) [xfseofblocks/0]
(root,0,0,00:00:45/1515-00:47:04,719) [xfseofblocks/1]
(root,0,0,00:00:00/1515-00:47:04,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1515-00:47:04,721) [xfs-cil/dm-3]
(root,0,0,00:01:46/1515-00:47:04,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1515-00:47:03,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1515-00:47:01,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1515-00:47:01,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1515-00:47:01,726) [xfssyncd/dm-2]
(root,0,0,08:04:12/1515-00:47:00,727) [xfsaild/dm-2]
(root,0,0,00:17:02/1515-00:46:33,728) [kjournald]
(root,0,0,00:07:28/1515-00:46:32,729) [xfsbufd/dm-5]
(root,0,0,00:06:10/1515-00:46:32,730) [xfs-cil/dm-5]
(root,0,0,00:07:07/1515-00:46:32,731) [xfssyncd/dm-5]
(root,0,0,10:53:09/1515-00:46:32,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1515-00:46:30,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1515-00:46:30,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1515-00:46:30,735) [xfssyncd/dm-7]
(root,0,0,08:06:45/1515-00:46:30,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1515-00:46:28,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1515-00:46:28,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1515-00:46:28,739) [xfssyncd/dm-6]
(root,0,0,08:07:10/1515-00:46:28,740) [xfsaild/dm-6]
(root,0,0,01:11:03/1515-00:46:09,816) [kauditd]
(root,93156,740,04:56:23/1515-00:45:55,1154) auditd
(root,249864,5540,02:46:19/1515-00:45:54,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:50/1515-00:45:53,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1515-00:45:52,1215) rpc.statd
(dbus,21580,1000,00:00:07/1515-00:45:50,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1515-00:45:48,1285) hald
(root,20400,836,00:00:00/1515-00:45:48,1286) hald-runner
(root,452700,1136,00:36:19/1515-00:45:42,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:16:43/1515-00:45:37,1375) /usr/sbin/sshd
(root,21716,804,00:24:43/1515-00:45:36,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:31/1515-00:45:32,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:34/1515-00:45:24,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1515-00:45:23,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:33/1515-00:45:13,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1515-00:45:11,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1515-00:45:11,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1515-00:45:11,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1439340,191604,9-11:36:44/1515-00:45:11,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:37/1515-00:44:51,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:47/1515-00:44:51,1759) inet_gethost 4
(root,112532,776,00:00:01/1515-00:44:50,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,594732,200480,01:30:30/1515-00:44:45,1776) /usr/sbin/httpd
(root,116864,704,00:13:06/1515-00:44:44,1786) crond
(root,21104,316,00:00:01/1515-00:44:44,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1515-00:44:44,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1515-00:44:44,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1515-00:44:44,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1515-00:44:44,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1515-00:44:44,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1515-00:44:44,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1515-00:44:44,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,596416,194500,00:00:00/3-07:43:22,2718) /usr/sbin/httpd
(apache,596416,194364,00:00:00/1-16:31:22,7252) /usr/sbin/httpd
(apache,596412,194312,00:00:00/1-16:31:21,7254) /usr/sbin/httpd
(apache,596416,194368,00:00:00/1-16:31:21,7255) /usr/sbin/httpd
(apache,596416,194328,00:00:00/1-16:31:20,7256) /usr/sbin/httpd
(apache,596416,194400,00:00:00/1-16:31:20,7257) /usr/sbin/httpd
(apache,596416,194384,00:00:00/1-16:31:19,7258) /usr/sbin/httpd
(apache,596416,194408,00:00:00/1-16:31:19,7259) /usr/sbin/httpd
(apache,594732,190136,00:00:00/3-16:03:00,19819) /usr/sbin/httpd
(apache,596416,194552,00:00:00/3-16:03:00,19820) /usr/sbin/httpd
(apache,596416,194460,00:00:00/3-16:03:00,19827) /usr/sbin/httpd
(apache,596416,194476,00:00:00/3-16:03:00,19836) /usr/sbin/httpd
(apache,596416,194476,00:00:00/3-16:03:00,19845) /usr/sbin/httpd
(apache,596416,194500,00:00:00/3-16:03:00,19852) /usr/sbin/httpd
(apache,596416,194500,00:00:00/3-16:03:00,19862) /usr/sbin/httpd
(apache,596416,194476,00:00:00/3-16:03:00,19871) /usr/sbin/httpd
(apache,596416,194496,00:00:00/3-16:03:00,19880) /usr/sbin/httpd
(root,108468,1060,00:00:00/712-08:57:29,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/712-08:57:29,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/712-08:57:29,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14988,2-12:59:39/712-08:57:29,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/01:08:43,21112) pickup -l -t fifo -u
(root,0,0,00:00:09/10-05:55:15,23952) [flush-253:5]
(apache,596424,194400,00:00:00/1-20:59:41,30195) /usr/sbin/httpd
(root,110268,1488,00:00:00/00:01,31577) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,31595) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,31596) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-31 23:25

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939cab23292

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:33:02/1513-00:22:34,1) /sbin/init
(root,0,0,00:00:05/1513-00:22:34,2) [kthreadd]
(root,0,0,00:13:59/1513-00:22:34,3) [migration/0]
(root,0,0,00:12:11/1513-00:22:34,4) [ksoftirqd/0]
(root,0,0,00:00:00/1513-00:22:34,5) [stopper/0]
(root,0,0,00:03:57/1513-00:22:34,6) [watchdog/0]
(root,0,0,00:20:38/1513-00:22:34,7) [migration/1]
(root,0,0,00:00:00/1513-00:22:34,8) [stopper/1]
(root,0,0,00:07:00/1513-00:22:34,9) [ksoftirqd/1]
(root,0,0,00:03:41/1513-00:22:34,10) [watchdog/1]
(root,0,0,02:41:38/1513-00:22:34,11) [events/0]
(root,0,0,02:52:05/1513-00:22:34,12) [events/1]
(root,0,0,00:00:00/1513-00:22:34,13) [cgroup]
(root,0,0,00:00:00/1513-00:22:34,14) [khelper]
(root,0,0,00:00:00/1513-00:22:34,15) [netns]
(root,0,0,00:00:00/1513-00:22:34,16) [async/mgr]
(root,0,0,00:00:00/1513-00:22:34,17) [pm]
(root,0,0,00:00:00/1513-00:22:34,18) [xenwatch]
(root,0,0,00:00:00/1513-00:22:34,19) [xenbus]
(root,0,0,00:08:38/1513-00:22:34,20) [sync_supers]
(root,0,0,00:10:14/1513-00:22:34,21) [bdi-default]
(root,0,0,00:00:00/1513-00:22:34,22) [kintegrityd/0]
(root,0,0,00:00:00/1513-00:22:34,23) [kintegrityd/1]
(root,0,0,00:08:58/1513-00:22:34,24) [kblockd/0]
(root,0,0,00:01:42/1513-00:22:34,25) [kblockd/1]
(root,0,0,00:00:00/1513-00:22:34,26) [ata_aux]
(root,0,0,00:00:00/1513-00:22:34,27) [ata_sff/0]
(root,0,0,00:00:00/1513-00:22:34,28) [ata_sff/1]
(root,0,0,00:00:00/1513-00:22:34,29) [ksuspend_usbd]
(root,0,0,00:00:00/1513-00:22:34,30) [khubd]
(root,0,0,00:00:00/1513-00:22:34,31) [kseriod]
(root,0,0,00:00:00/1513-00:22:34,32) [md/0]
(root,0,0,00:00:00/1513-00:22:34,33) [md/1]
(root,0,0,00:00:00/1513-00:22:34,34) [md_misc/0]
(root,0,0,00:00:00/1513-00:22:34,35) [md_misc/1]
(root,0,0,00:00:00/1513-00:22:34,36) [linkwatch]
(root,0,0,00:00:49/1513-00:22:34,37) [khungtaskd]
(root,0,0,00:00:07/1513-00:22:34,38) [kswapd0]
(root,0,0,00:00:00/1513-00:22:34,39) [ksmd]
(root,0,0,00:00:00/1513-00:22:34,40) [aio/0]
(root,0,0,00:00:00/1513-00:22:34,41) [aio/1]
(root,0,0,00:00:00/1513-00:22:34,42) [crypto/0]
(root,0,0,00:00:00/1513-00:22:34,43) [crypto/1]
(root,0,0,00:00:00/1513-00:22:34,51) [kthrotld/0]
(root,0,0,00:00:00/1513-00:22:34,52) [kthrotld/1]
(root,0,0,00:00:00/1513-00:22:34,54) [khvcd]
(root,0,0,00:00:00/1513-00:22:34,55) [kpsmoused]
(root,0,0,00:00:00/1513-00:22:34,56) [usbhid_resumer]
(root,0,0,00:00:00/1513-00:22:34,57) [deferwq]
(root,0,0,00:00:00/1513-00:22:34,89) [kdmremove]
(root,0,0,00:00:00/1513-00:22:34,90) [kstriped]
(root,0,0,00:00:00/1513-00:22:29,233) [kdmflush]
(root,0,0,00:00:00/1513-00:22:29,235) [kdmflush]
(root,0,0,00:00:27/1513-00:22:16,252) [kjournald]
(root,10936,368,00:00:00/1513-00:21:56,341) /sbin/udevd -d
(root,0,0,00:00:00/1513-00:21:41,610) [kdmflush]
(root,0,0,00:00:00/1513-00:21:41,613) [kdmflush]
(root,0,0,00:00:00/1513-00:21:41,616) [kdmflush]
(root,0,0,00:00:00/1513-00:21:41,621) [kdmflush]
(root,0,0,00:00:00/1513-00:21:41,627) [kdmflush]
(root,10932,472,00:00:00/1513-00:21:41,628) /sbin/udevd -d
(root,0,0,00:00:00/1513-00:21:41,631) [kdmflush]
(root,10932,436,00:00:00/1513-00:21:41,632) /sbin/udevd -d
(root,0,0,00:16:31/1513-00:21:29,702) [flush-253:4]
(root,0,0,00:00:00/1513-00:21:20,706) [kjournald]
(root,0,0,00:00:00/1513-00:21:19,709) [xfs_mru_cache]
(root,0,0,00:11:10/1513-00:21:19,710) [xfslogd/0]
(root,0,0,00:00:00/1513-00:21:19,711) [xfslogd/1]
(root,0,0,00:15:21/1513-00:21:19,712) [xfsdatad/0]
(root,0,0,00:00:00/1513-00:21:19,713) [xfsdatad/1]
(root,0,0,00:00:00/1513-00:21:19,714) [xfsconvertd/0]
(root,0,0,00:00:00/1513-00:21:19,715) [xfsconvertd/1]
(root,0,0,00:00:12/1513-00:21:19,716) [xfsalloc/0]
(root,0,0,00:00:35/1513-00:21:19,717) [xfsalloc/1]
(root,0,0,00:00:12/1513-00:21:19,718) [xfseofblocks/0]
(root,0,0,00:00:45/1513-00:21:19,719) [xfseofblocks/1]
(root,0,0,00:00:00/1513-00:21:19,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1513-00:21:19,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1513-00:21:19,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1513-00:21:18,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1513-00:21:16,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1513-00:21:16,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1513-00:21:16,726) [xfssyncd/dm-2]
(root,0,0,08:03:30/1513-00:21:15,727) [xfsaild/dm-2]
(root,0,0,00:17:00/1513-00:20:48,728) [kjournald]
(root,0,0,00:07:28/1513-00:20:47,729) [xfsbufd/dm-5]
(root,0,0,00:06:09/1513-00:20:47,730) [xfs-cil/dm-5]
(root,0,0,00:07:06/1513-00:20:47,731) [xfssyncd/dm-5]
(root,0,0,10:52:14/1513-00:20:47,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1513-00:20:45,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1513-00:20:45,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1513-00:20:45,735) [xfssyncd/dm-7]
(root,0,0,08:06:03/1513-00:20:45,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1513-00:20:43,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1513-00:20:43,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1513-00:20:43,739) [xfssyncd/dm-6]
(root,0,0,08:06:28/1513-00:20:43,740) [xfsaild/dm-6]
(root,0,0,01:10:49/1513-00:20:24,816) [kauditd]
(root,93156,740,04:55:26/1513-00:20:10,1154) auditd
(root,249864,5540,02:45:50/1513-00:20:09,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:49/1513-00:20:08,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1513-00:20:07,1215) rpc.statd
(dbus,21580,1000,00:00:07/1513-00:20:05,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1513-00:20:03,1285) hald
(root,20400,836,00:00:00/1513-00:20:03,1286) hald-runner
(root,452700,1136,00:36:16/1513-00:19:57,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:15:28/1513-00:19:52,1375) /usr/sbin/sshd
(root,21716,804,00:24:41/1513-00:19:51,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:29/1513-00:19:47,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:33/1513-00:19:39,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:38/1513-00:19:38,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:31/1513-00:19:28,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1513-00:19:26,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1513-00:19:26,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1513-00:19:26,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1440964,191828,9-11:17:55/1513-00:19:26,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:37/1513-00:19:06,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:46/1513-00:19:06,1759) inet_gethost 4
(root,112532,776,00:00:01/1513-00:19:05,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,594732,200480,01:30:21/1513-00:19:00,1776) /usr/sbin/httpd
(root,116864,704,00:13:05/1513-00:18:59,1786) crond
(root,21104,316,00:00:01/1513-00:18:59,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1513-00:18:59,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1513-00:18:59,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1513-00:18:59,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1513-00:18:59,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1513-00:18:59,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1513-00:18:59,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1513-00:18:59,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,596416,194416,00:00:00/1-07:17:37,2718) /usr/sbin/httpd
(apache,594732,190136,00:00:00/1-15:37:15,19819) /usr/sbin/httpd
(apache,596416,194484,00:00:00/1-15:37:15,19820) /usr/sbin/httpd
(apache,596416,194420,00:00:00/1-15:37:15,19827) /usr/sbin/httpd
(apache,596416,194420,00:00:00/1-15:37:15,19836) /usr/sbin/httpd
(apache,596416,194432,00:00:00/1-15:37:15,19845) /usr/sbin/httpd
(apache,596416,194428,00:00:00/1-15:37:15,19852) /usr/sbin/httpd
(apache,596416,194468,00:00:00/1-15:37:15,19862) /usr/sbin/httpd
(apache,596416,194412,00:00:00/1-15:37:15,19871) /usr/sbin/httpd
(apache,596416,194444,00:00:00/1-15:37:15,19880) /usr/sbin/httpd
(root,108468,1060,00:00:00/710-08:31:44,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/710-08:31:44,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/710-08:31:44,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15708,2-12:47:57/710-08:31:44,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3360,00:00:00/01:05:25,22645) pickup -l -t fifo -u
(root,0,0,00:00:07/8-05:29:30,23952) [flush-253:5]
(root,98636,3776,00:00:00/00:08,32455) sshd: rpcuser [priv]
(sshd,67568,1656,00:00:00/00:07,32456) sshd: rpcuser [net]
(root,98636,3776,00:00:00/00:07,32457) sshd: zabbix [priv]
(sshd,67568,1656,00:00:00/00:07,32458) sshd: zabbix [net]
(root,101288,4276,00:00:00/00:03,32464) sshd: root [priv]
(sshd,67568,1640,00:00:00/00:03,32465) sshd: root [net] 
(root,110268,1492,00:00:00/00:01,32483) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,32501) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,804,00:00:00/00:01,32502) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-29 22:59

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79399493dfda

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:56/1511-00:41:36,1) /sbin/init
(root,0,0,00:00:05/1511-00:41:36,2) [kthreadd]
(root,0,0,00:13:58/1511-00:41:36,3) [migration/0]
(root,0,0,00:12:10/1511-00:41:36,4) [ksoftirqd/0]
(root,0,0,00:00:00/1511-00:41:36,5) [stopper/0]
(root,0,0,00:03:56/1511-00:41:36,6) [watchdog/0]
(root,0,0,00:20:36/1511-00:41:36,7) [migration/1]
(root,0,0,00:00:00/1511-00:41:36,8) [stopper/1]
(root,0,0,00:06:59/1511-00:41:36,9) [ksoftirqd/1]
(root,0,0,00:03:41/1511-00:41:36,10) [watchdog/1]
(root,0,0,02:41:25/1511-00:41:36,11) [events/0]
(root,0,0,02:51:50/1511-00:41:36,12) [events/1]
(root,0,0,00:00:00/1511-00:41:36,13) [cgroup]
(root,0,0,00:00:00/1511-00:41:36,14) [khelper]
(root,0,0,00:00:00/1511-00:41:36,15) [netns]
(root,0,0,00:00:00/1511-00:41:36,16) [async/mgr]
(root,0,0,00:00:00/1511-00:41:36,17) [pm]
(root,0,0,00:00:00/1511-00:41:36,18) [xenwatch]
(root,0,0,00:00:00/1511-00:41:36,19) [xenbus]
(root,0,0,00:08:37/1511-00:41:36,20) [sync_supers]
(root,0,0,00:10:13/1511-00:41:36,21) [bdi-default]
(root,0,0,00:00:00/1511-00:41:36,22) [kintegrityd/0]
(root,0,0,00:00:00/1511-00:41:36,23) [kintegrityd/1]
(root,0,0,00:08:57/1511-00:41:36,24) [kblockd/0]
(root,0,0,00:01:42/1511-00:41:36,25) [kblockd/1]
(root,0,0,00:00:00/1511-00:41:36,26) [ata_aux]
(root,0,0,00:00:00/1511-00:41:36,27) [ata_sff/0]
(root,0,0,00:00:00/1511-00:41:36,28) [ata_sff/1]
(root,0,0,00:00:00/1511-00:41:36,29) [ksuspend_usbd]
(root,0,0,00:00:00/1511-00:41:36,30) [khubd]
(root,0,0,00:00:00/1511-00:41:36,31) [kseriod]
(root,0,0,00:00:00/1511-00:41:36,32) [md/0]
(root,0,0,00:00:00/1511-00:41:36,33) [md/1]
(root,0,0,00:00:00/1511-00:41:36,34) [md_misc/0]
(root,0,0,00:00:00/1511-00:41:36,35) [md_misc/1]
(root,0,0,00:00:00/1511-00:41:36,36) [linkwatch]
(root,0,0,00:00:49/1511-00:41:36,37) [khungtaskd]
(root,0,0,00:00:07/1511-00:41:36,38) [kswapd0]
(root,0,0,00:00:00/1511-00:41:36,39) [ksmd]
(root,0,0,00:00:00/1511-00:41:36,40) [aio/0]
(root,0,0,00:00:00/1511-00:41:36,41) [aio/1]
(root,0,0,00:00:00/1511-00:41:36,42) [crypto/0]
(root,0,0,00:00:00/1511-00:41:36,43) [crypto/1]
(root,0,0,00:00:00/1511-00:41:36,51) [kthrotld/0]
(root,0,0,00:00:00/1511-00:41:36,52) [kthrotld/1]
(root,0,0,00:00:00/1511-00:41:36,54) [khvcd]
(root,0,0,00:00:00/1511-00:41:36,55) [kpsmoused]
(root,0,0,00:00:00/1511-00:41:36,56) [usbhid_resumer]
(root,0,0,00:00:00/1511-00:41:36,57) [deferwq]
(root,0,0,00:00:00/1511-00:41:36,89) [kdmremove]
(root,0,0,00:00:00/1511-00:41:36,90) [kstriped]
(root,0,0,00:00:00/1511-00:41:31,233) [kdmflush]
(root,0,0,00:00:00/1511-00:41:31,235) [kdmflush]
(root,0,0,00:00:27/1511-00:41:18,252) [kjournald]
(root,10936,368,00:00:00/1511-00:40:58,341) /sbin/udevd -d
(root,0,0,00:00:00/1511-00:40:43,610) [kdmflush]
(root,0,0,00:00:00/1511-00:40:43,613) [kdmflush]
(root,0,0,00:00:00/1511-00:40:43,616) [kdmflush]
(root,0,0,00:00:00/1511-00:40:43,621) [kdmflush]
(root,0,0,00:00:00/1511-00:40:43,627) [kdmflush]
(root,10932,472,00:00:00/1511-00:40:43,628) /sbin/udevd -d
(root,0,0,00:00:00/1511-00:40:43,631) [kdmflush]
(root,10932,436,00:00:00/1511-00:40:43,632) /sbin/udevd -d
(root,0,0,00:16:29/1511-00:40:31,702) [flush-253:4]
(root,0,0,00:00:00/1511-00:40:22,706) [kjournald]
(root,0,0,00:00:00/1511-00:40:21,709) [xfs_mru_cache]
(root,0,0,00:11:08/1511-00:40:21,710) [xfslogd/0]
(root,0,0,00:00:00/1511-00:40:21,711) [xfslogd/1]
(root,0,0,00:15:19/1511-00:40:21,712) [xfsdatad/0]
(root,0,0,00:00:00/1511-00:40:21,713) [xfsdatad/1]
(root,0,0,00:00:00/1511-00:40:21,714) [xfsconvertd/0]
(root,0,0,00:00:00/1511-00:40:21,715) [xfsconvertd/1]
(root,0,0,00:00:12/1511-00:40:21,716) [xfsalloc/0]
(root,0,0,00:00:35/1511-00:40:21,717) [xfsalloc/1]
(root,0,0,00:00:12/1511-00:40:21,718) [xfseofblocks/0]
(root,0,0,00:00:45/1511-00:40:21,719) [xfseofblocks/1]
(root,0,0,00:00:00/1511-00:40:21,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1511-00:40:21,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1511-00:40:21,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1511-00:40:20,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1511-00:40:18,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1511-00:40:18,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1511-00:40:18,726) [xfssyncd/dm-2]
(root,0,0,08:02:49/1511-00:40:17,727) [xfsaild/dm-2]
(root,0,0,00:16:59/1511-00:39:50,728) [kjournald]
(root,0,0,00:07:27/1511-00:39:49,729) [xfsbufd/dm-5]
(root,0,0,00:06:08/1511-00:39:49,730) [xfs-cil/dm-5]
(root,0,0,00:07:06/1511-00:39:49,731) [xfssyncd/dm-5]
(root,0,0,10:51:20/1511-00:39:49,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1511-00:39:47,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1511-00:39:47,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1511-00:39:47,735) [xfssyncd/dm-7]
(root,0,0,08:05:21/1511-00:39:47,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1511-00:39:45,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1511-00:39:45,738) [xfs-cil/dm-6]
(root,0,0,00:01:49/1511-00:39:45,739) [xfssyncd/dm-6]
(root,0,0,08:05:47/1511-00:39:45,740) [xfsaild/dm-6]
(root,0,0,01:10:37/1511-00:39:26,816) [kauditd]
(root,93156,740,04:54:31/1511-00:39:12,1154) auditd
(root,249864,5540,02:45:23/1511-00:39:11,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:49/1511-00:39:10,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1511-00:39:09,1215) rpc.statd
(dbus,21580,1000,00:00:07/1511-00:39:07,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1511-00:39:05,1285) hald
(root,20400,836,00:00:00/1511-00:39:05,1286) hald-runner
(root,452700,1136,00:36:13/1511-00:38:59,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:14:16/1511-00:38:54,1375) /usr/sbin/sshd
(root,21716,804,00:24:39/1511-00:38:53,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:26/1511-00:38:49,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:32/1511-00:38:41,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1511-00:38:40,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:29/1511-00:38:30,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1511-00:38:28,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1511-00:38:28,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1511-00:38:28,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1440964,191760,9-10:59:25/1511-00:38:28,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:37/1511-00:38:08,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:46/1511-00:38:08,1759) inet_gethost 4
(root,112532,776,00:00:01/1511-00:38:07,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593808,199632,01:30:12/1511-00:38:02,1776) /usr/sbin/httpd
(root,116864,704,00:13:04/1511-00:38:01,1786) crond
(root,21104,316,00:00:01/1511-00:38:01,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1511-00:38:01,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1511-00:38:01,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1511-00:38:01,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1511-00:38:01,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1511-00:38:01,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1511-00:38:01,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1511-00:38:01,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,595580,193460,00:00:00/15:18:18,4562) /usr/sbin/httpd
(apache,595580,193532,00:00:00/15:18:00,4580) /usr/sbin/httpd
(apache,595580,193496,00:00:00/15:17:26,4629) /usr/sbin/httpd
(apache,595580,193532,00:00:00/15:17:24,4630) /usr/sbin/httpd
(apache,595568,193556,00:00:00/15:17:24,4631) /usr/sbin/httpd
(apache,593808,189292,00:00:00/6-15:55:16,6090) /usr/sbin/httpd
(apache,595568,193768,00:00:00/6-15:55:16,6102) /usr/sbin/httpd
(apache,595568,193704,00:00:00/6-15:55:16,6107) /usr/sbin/httpd
(apache,595580,193768,00:00:00/6-15:55:16,6112) /usr/sbin/httpd
(apache,595580,193736,00:00:00/6-15:55:16,6113) /usr/sbin/httpd
(apache,595580,193760,00:00:00/6-15:55:16,6118) /usr/sbin/httpd
(apache,595580,193744,00:00:00/6-15:55:15,6128) /usr/sbin/httpd
(apache,595580,193764,00:00:00/6-15:55:15,6138) /usr/sbin/httpd
(apache,595580,193728,00:00:00/6-15:55:15,6147) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/06:54,7802) pickup -l -t fifo -u
(root,0,0,00:00:00/00:10,8683) [flush-253:1]
(root,0,0,00:00:00/00:10,8684) [flush-253:6]
(root,101288,4268,00:00:00/00:05,8787) sshd: root [priv]
(sshd,67568,1656,00:00:00/00:04,8788) sshd: root [net] 
(root,66224,3104,00:00:00/00:01,8790) sshd: [accepted] 
(root,110268,1492,00:00:00/00:01,8823) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,8841) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,8842) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/708-08:50:46,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/708-08:50:46,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/708-08:50:46,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15252,2-12:36:33/708-08:50:46,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:05/6-05:48:32,23952) [flush-253:5]
(apache,595580,193712,00:00:00/5-12:50:20,32266) /usr/sbin/httpd
(apache,595580,193716,00:00:00/5-12:50:19,32270) /usr/sbin/httpd
(apache,595580,193732,00:00:00/5-12:50:19,32272) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-27 23:18

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79397b604afd

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:50/1509-00:35:49,1) /sbin/init
(root,0,0,00:00:05/1509-00:35:49,2) [kthreadd]
(root,0,0,00:13:56/1509-00:35:49,3) [migration/0]
(root,0,0,00:12:08/1509-00:35:49,4) [ksoftirqd/0]
(root,0,0,00:00:00/1509-00:35:49,5) [stopper/0]
(root,0,0,00:03:56/1509-00:35:49,6) [watchdog/0]
(root,0,0,00:20:33/1509-00:35:49,7) [migration/1]
(root,0,0,00:00:00/1509-00:35:49,8) [stopper/1]
(root,0,0,00:06:59/1509-00:35:49,9) [ksoftirqd/1]
(root,0,0,00:03:41/1509-00:35:49,10) [watchdog/1]
(root,0,0,02:41:12/1509-00:35:49,11) [events/0]
(root,0,0,02:51:34/1509-00:35:49,12) [events/1]
(root,0,0,00:00:00/1509-00:35:49,13) [cgroup]
(root,0,0,00:00:00/1509-00:35:49,14) [khelper]
(root,0,0,00:00:00/1509-00:35:49,15) [netns]
(root,0,0,00:00:00/1509-00:35:49,16) [async/mgr]
(root,0,0,00:00:00/1509-00:35:49,17) [pm]
(root,0,0,00:00:00/1509-00:35:49,18) [xenwatch]
(root,0,0,00:00:00/1509-00:35:49,19) [xenbus]
(root,0,0,00:08:36/1509-00:35:49,20) [sync_supers]
(root,0,0,00:10:13/1509-00:35:49,21) [bdi-default]
(root,0,0,00:00:00/1509-00:35:49,22) [kintegrityd/0]
(root,0,0,00:00:00/1509-00:35:49,23) [kintegrityd/1]
(root,0,0,00:08:56/1509-00:35:49,24) [kblockd/0]
(root,0,0,00:01:42/1509-00:35:49,25) [kblockd/1]
(root,0,0,00:00:00/1509-00:35:49,26) [ata_aux]
(root,0,0,00:00:00/1509-00:35:49,27) [ata_sff/0]
(root,0,0,00:00:00/1509-00:35:49,28) [ata_sff/1]
(root,0,0,00:00:00/1509-00:35:49,29) [ksuspend_usbd]
(root,0,0,00:00:00/1509-00:35:49,30) [khubd]
(root,0,0,00:00:00/1509-00:35:49,31) [kseriod]
(root,0,0,00:00:00/1509-00:35:49,32) [md/0]
(root,0,0,00:00:00/1509-00:35:49,33) [md/1]
(root,0,0,00:00:00/1509-00:35:49,34) [md_misc/0]
(root,0,0,00:00:00/1509-00:35:49,35) [md_misc/1]
(root,0,0,00:00:00/1509-00:35:49,36) [linkwatch]
(root,0,0,00:00:49/1509-00:35:49,37) [khungtaskd]
(root,0,0,00:00:07/1509-00:35:49,38) [kswapd0]
(root,0,0,00:00:00/1509-00:35:49,39) [ksmd]
(root,0,0,00:00:00/1509-00:35:49,40) [aio/0]
(root,0,0,00:00:00/1509-00:35:49,41) [aio/1]
(root,0,0,00:00:00/1509-00:35:49,42) [crypto/0]
(root,0,0,00:00:00/1509-00:35:49,43) [crypto/1]
(root,0,0,00:00:00/1509-00:35:49,51) [kthrotld/0]
(root,0,0,00:00:00/1509-00:35:49,52) [kthrotld/1]
(root,0,0,00:00:00/1509-00:35:49,54) [khvcd]
(root,0,0,00:00:00/1509-00:35:49,55) [kpsmoused]
(root,0,0,00:00:00/1509-00:35:49,56) [usbhid_resumer]
(root,0,0,00:00:00/1509-00:35:49,57) [deferwq]
(root,0,0,00:00:00/1509-00:35:49,89) [kdmremove]
(root,0,0,00:00:00/1509-00:35:49,90) [kstriped]
(root,0,0,00:00:00/1509-00:35:44,233) [kdmflush]
(root,0,0,00:00:00/1509-00:35:44,235) [kdmflush]
(root,0,0,00:00:27/1509-00:35:31,252) [kjournald]
(root,10936,368,00:00:00/1509-00:35:11,341) /sbin/udevd -d
(root,0,0,00:00:00/1509-00:34:56,610) [kdmflush]
(root,0,0,00:00:00/1509-00:34:56,613) [kdmflush]
(root,0,0,00:00:00/1509-00:34:56,616) [kdmflush]
(root,0,0,00:00:00/1509-00:34:56,621) [kdmflush]
(root,0,0,00:00:00/1509-00:34:56,627) [kdmflush]
(root,10932,472,00:00:00/1509-00:34:56,628) /sbin/udevd -d
(root,0,0,00:00:00/1509-00:34:56,631) [kdmflush]
(root,10932,436,00:00:00/1509-00:34:56,632) /sbin/udevd -d
(root,0,0,00:16:28/1509-00:34:44,702) [flush-253:4]
(root,0,0,00:00:00/1509-00:34:35,706) [kjournald]
(root,0,0,00:00:00/1509-00:34:34,709) [xfs_mru_cache]
(root,0,0,00:11:07/1509-00:34:34,710) [xfslogd/0]
(root,0,0,00:00:00/1509-00:34:34,711) [xfslogd/1]
(root,0,0,00:15:16/1509-00:34:34,712) [xfsdatad/0]
(root,0,0,00:00:00/1509-00:34:34,713) [xfsdatad/1]
(root,0,0,00:00:00/1509-00:34:34,714) [xfsconvertd/0]
(root,0,0,00:00:00/1509-00:34:34,715) [xfsconvertd/1]
(root,0,0,00:00:12/1509-00:34:34,716) [xfsalloc/0]
(root,0,0,00:00:35/1509-00:34:34,717) [xfsalloc/1]
(root,0,0,00:00:12/1509-00:34:34,718) [xfseofblocks/0]
(root,0,0,00:00:45/1509-00:34:34,719) [xfseofblocks/1]
(root,0,0,00:00:00/1509-00:34:34,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1509-00:34:34,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1509-00:34:34,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1509-00:34:33,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1509-00:34:31,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1509-00:34:31,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1509-00:34:31,726) [xfssyncd/dm-2]
(root,0,0,08:02:09/1509-00:34:30,727) [xfsaild/dm-2]
(root,0,0,00:16:58/1509-00:34:03,728) [kjournald]
(root,0,0,00:07:27/1509-00:34:02,729) [xfsbufd/dm-5]
(root,0,0,00:06:07/1509-00:34:02,730) [xfs-cil/dm-5]
(root,0,0,00:07:05/1509-00:34:02,731) [xfssyncd/dm-5]
(root,0,0,10:50:27/1509-00:34:02,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1509-00:34:00,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1509-00:34:00,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1509-00:34:00,735) [xfssyncd/dm-7]
(root,0,0,08:04:42/1509-00:34:00,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1509-00:33:58,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1509-00:33:58,738) [xfs-cil/dm-6]
(root,0,0,00:01:48/1509-00:33:58,739) [xfssyncd/dm-6]
(root,0,0,08:05:06/1509-00:33:58,740) [xfsaild/dm-6]
(root,0,0,01:10:25/1509-00:33:39,816) [kauditd]
(root,93156,740,04:53:42/1509-00:33:25,1154) auditd
(root,249864,5540,02:44:57/1509-00:33:24,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:49/1509-00:33:23,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1509-00:33:22,1215) rpc.statd
(dbus,21580,1000,00:00:07/1509-00:33:20,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1509-00:33:18,1285) hald
(root,20400,836,00:00:00/1509-00:33:18,1286) hald-runner
(root,452700,1136,00:36:10/1509-00:33:12,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:13:12/1509-00:33:07,1375) /usr/sbin/sshd
(root,21716,804,00:24:37/1509-00:33:06,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:24/1509-00:33:02,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:31/1509-00:32:54,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1509-00:32:53,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:27/1509-00:32:43,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1509-00:32:41,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1509-00:32:41,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1509-00:32:41,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1439340,191724,9-10:40:43/1509-00:32:41,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:37/1509-00:32:21,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:46/1509-00:32:21,1759) inet_gethost 4
(root,112532,776,00:00:01/1509-00:32:20,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593808,199632,01:30:04/1509-00:32:15,1776) /usr/sbin/httpd
(root,116864,704,00:13:03/1509-00:32:14,1786) crond
(root,21104,316,00:00:01/1509-00:32:14,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1509-00:32:14,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1509-00:32:14,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1509-00:32:14,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1509-00:32:14,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1509-00:32:14,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1509-00:32:14,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1509-00:32:14,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,593808,189292,00:00:00/4-15:49:29,6090) /usr/sbin/httpd
(apache,595568,193764,00:00:00/4-15:49:29,6102) /usr/sbin/httpd
(apache,595568,193672,00:00:00/4-15:49:29,6107) /usr/sbin/httpd
(apache,595580,193744,00:00:00/4-15:49:29,6112) /usr/sbin/httpd
(apache,595580,193724,00:00:00/4-15:49:29,6113) /usr/sbin/httpd
(apache,595580,193736,00:00:00/4-15:49:29,6118) /usr/sbin/httpd
(apache,595580,193724,00:00:00/4-15:49:28,6128) /usr/sbin/httpd
(apache,595580,193736,00:00:00/4-15:49:28,6138) /usr/sbin/httpd
(apache,595580,193704,00:00:00/4-15:49:28,6147) /usr/sbin/httpd
(root,108468,1060,00:00:00/706-08:44:59,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/706-08:44:59,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/706-08:44:59,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15076,2-12:25:13/706-08:44:59,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:03/4-05:42:45,23952) [flush-253:5]
(postfix,80944,3360,00:00:00/23:33,27177) pickup -l -t fifo -u
(root,0,0,00:00:00/06:39,29651) [flush-253:1]
(root,98636,3780,00:00:00/00:06,30528) sshd: shutdown [priv]
(sshd,67568,1648,00:00:00/00:05,30529) sshd: shutdown [net]
(root,67568,3244,00:00:00/00:05,30532) sshd: [accepted] 
(sshd,67568,1580,00:00:00/00:04,30533) sshd: [net]      
(root,110268,1492,00:00:00/00:01,30634) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,30652) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,30653) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,595580,193684,00:00:00/3-12:44:33,32266) /usr/sbin/httpd
(apache,595580,193692,00:00:00/3-12:44:32,32270) /usr/sbin/httpd
(apache,595580,193696,00:00:00/3-12:44:32,32272) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-25 23:12

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79390fd9830a

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:43/1506-23:00:26,1) /sbin/init
(root,0,0,00:00:05/1506-23:00:26,2) [kthreadd]
(root,0,0,00:13:55/1506-23:00:26,3) [migration/0]
(root,0,0,00:12:07/1506-23:00:26,4) [ksoftirqd/0]
(root,0,0,00:00:00/1506-23:00:26,5) [stopper/0]
(root,0,0,00:03:56/1506-23:00:26,6) [watchdog/0]
(root,0,0,00:20:31/1506-23:00:26,7) [migration/1]
(root,0,0,00:00:00/1506-23:00:26,8) [stopper/1]
(root,0,0,00:06:58/1506-23:00:26,9) [ksoftirqd/1]
(root,0,0,00:03:40/1506-23:00:26,10) [watchdog/1]
(root,0,0,02:40:58/1506-23:00:26,11) [events/0]
(root,0,0,02:51:19/1506-23:00:26,12) [events/1]
(root,0,0,00:00:00/1506-23:00:26,13) [cgroup]
(root,0,0,00:00:00/1506-23:00:26,14) [khelper]
(root,0,0,00:00:00/1506-23:00:26,15) [netns]
(root,0,0,00:00:00/1506-23:00:26,16) [async/mgr]
(root,0,0,00:00:00/1506-23:00:26,17) [pm]
(root,0,0,00:00:00/1506-23:00:26,18) [xenwatch]
(root,0,0,00:00:00/1506-23:00:26,19) [xenbus]
(root,0,0,00:08:35/1506-23:00:26,20) [sync_supers]
(root,0,0,00:10:12/1506-23:00:26,21) [bdi-default]
(root,0,0,00:00:00/1506-23:00:26,22) [kintegrityd/0]
(root,0,0,00:00:00/1506-23:00:26,23) [kintegrityd/1]
(root,0,0,00:08:55/1506-23:00:26,24) [kblockd/0]
(root,0,0,00:01:42/1506-23:00:26,25) [kblockd/1]
(root,0,0,00:00:00/1506-23:00:26,26) [ata_aux]
(root,0,0,00:00:00/1506-23:00:26,27) [ata_sff/0]
(root,0,0,00:00:00/1506-23:00:26,28) [ata_sff/1]
(root,0,0,00:00:00/1506-23:00:26,29) [ksuspend_usbd]
(root,0,0,00:00:00/1506-23:00:26,30) [khubd]
(root,0,0,00:00:00/1506-23:00:26,31) [kseriod]
(root,0,0,00:00:00/1506-23:00:26,32) [md/0]
(root,0,0,00:00:00/1506-23:00:26,33) [md/1]
(root,0,0,00:00:00/1506-23:00:26,34) [md_misc/0]
(root,0,0,00:00:00/1506-23:00:26,35) [md_misc/1]
(root,0,0,00:00:00/1506-23:00:26,36) [linkwatch]
(root,0,0,00:00:49/1506-23:00:26,37) [khungtaskd]
(root,0,0,00:00:07/1506-23:00:26,38) [kswapd0]
(root,0,0,00:00:00/1506-23:00:26,39) [ksmd]
(root,0,0,00:00:00/1506-23:00:26,40) [aio/0]
(root,0,0,00:00:00/1506-23:00:26,41) [aio/1]
(root,0,0,00:00:00/1506-23:00:26,42) [crypto/0]
(root,0,0,00:00:00/1506-23:00:26,43) [crypto/1]
(root,0,0,00:00:00/1506-23:00:26,51) [kthrotld/0]
(root,0,0,00:00:00/1506-23:00:26,52) [kthrotld/1]
(root,0,0,00:00:00/1506-23:00:26,54) [khvcd]
(root,0,0,00:00:00/1506-23:00:26,55) [kpsmoused]
(root,0,0,00:00:00/1506-23:00:26,56) [usbhid_resumer]
(root,0,0,00:00:00/1506-23:00:26,57) [deferwq]
(root,0,0,00:00:00/1506-23:00:26,89) [kdmremove]
(root,0,0,00:00:00/1506-23:00:26,90) [kstriped]
(root,0,0,00:00:00/1506-23:00:21,233) [kdmflush]
(root,0,0,00:00:00/1506-23:00:21,235) [kdmflush]
(root,0,0,00:00:27/1506-23:00:08,252) [kjournald]
(root,10936,368,00:00:00/1506-22:59:48,341) /sbin/udevd -d
(root,0,0,00:00:00/1506-22:59:33,610) [kdmflush]
(root,0,0,00:00:00/1506-22:59:33,613) [kdmflush]
(root,0,0,00:00:00/1506-22:59:33,616) [kdmflush]
(root,0,0,00:00:00/1506-22:59:33,621) [kdmflush]
(root,0,0,00:00:00/1506-22:59:33,627) [kdmflush]
(root,10932,472,00:00:00/1506-22:59:33,628) /sbin/udevd -d
(root,0,0,00:00:00/1506-22:59:33,631) [kdmflush]
(root,10932,436,00:00:00/1506-22:59:33,632) /sbin/udevd -d
(root,0,0,00:16:26/1506-22:59:21,702) [flush-253:4]
(root,0,0,00:00:00/1506-22:59:12,706) [kjournald]
(root,0,0,00:00:00/1506-22:59:11,709) [xfs_mru_cache]
(root,0,0,00:11:05/1506-22:59:11,710) [xfslogd/0]
(root,0,0,00:00:00/1506-22:59:11,711) [xfslogd/1]
(root,0,0,00:15:14/1506-22:59:11,712) [xfsdatad/0]
(root,0,0,00:00:00/1506-22:59:11,713) [xfsdatad/1]
(root,0,0,00:00:00/1506-22:59:11,714) [xfsconvertd/0]
(root,0,0,00:00:00/1506-22:59:11,715) [xfsconvertd/1]
(root,0,0,00:00:12/1506-22:59:11,716) [xfsalloc/0]
(root,0,0,00:00:35/1506-22:59:11,717) [xfsalloc/1]
(root,0,0,00:00:12/1506-22:59:11,718) [xfseofblocks/0]
(root,0,0,00:00:45/1506-22:59:11,719) [xfseofblocks/1]
(root,0,0,00:00:00/1506-22:59:11,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1506-22:59:11,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1506-22:59:11,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1506-22:59:10,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1506-22:59:08,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1506-22:59:08,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1506-22:59:08,726) [xfssyncd/dm-2]
(root,0,0,08:01:25/1506-22:59:07,727) [xfsaild/dm-2]
(root,0,0,00:16:56/1506-22:58:40,728) [kjournald]
(root,0,0,00:07:27/1506-22:58:39,729) [xfsbufd/dm-5]
(root,0,0,00:06:06/1506-22:58:39,730) [xfs-cil/dm-5]
(root,0,0,00:07:05/1506-22:58:39,731) [xfssyncd/dm-5]
(root,0,0,10:49:32/1506-22:58:39,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1506-22:58:37,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1506-22:58:37,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1506-22:58:37,735) [xfssyncd/dm-7]
(root,0,0,08:03:57/1506-22:58:37,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1506-22:58:35,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1506-22:58:35,738) [xfs-cil/dm-6]
(root,0,0,00:01:48/1506-22:58:35,739) [xfssyncd/dm-6]
(root,0,0,08:04:22/1506-22:58:35,740) [xfsaild/dm-6]
(root,0,0,01:10:11/1506-22:58:16,816) [kauditd]
(root,93156,740,04:52:44/1506-22:58:02,1154) auditd
(root,249864,5540,02:44:25/1506-22:58:01,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:48/1506-22:58:00,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1506-22:57:59,1215) rpc.statd
(dbus,21580,1000,00:00:07/1506-22:57:57,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1506-22:57:55,1285) hald
(root,20400,836,00:00:00/1506-22:57:55,1286) hald-runner
(root,452700,1136,00:36:07/1506-22:57:49,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:11:57/1506-22:57:44,1375) /usr/sbin/sshd
(root,21716,804,00:24:35/1506-22:57:43,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:21/1506-22:57:39,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:30/1506-22:57:31,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1506-22:57:30,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:25/1506-22:57:20,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1506-22:57:18,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1506-22:57:18,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1506-22:57:18,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1439340,191344,9-10:21:42/1506-22:57:18,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:37/1506-22:56:58,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:45/1506-22:56:58,1759) inet_gethost 4
(root,112532,776,00:00:01/1506-22:56:57,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593808,199632,01:29:56/1506-22:56:52,1776) /usr/sbin/httpd
(root,116864,704,00:13:02/1506-22:56:51,1786) crond
(root,21104,316,00:00:01/1506-22:56:51,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1506-22:56:51,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1506-22:56:51,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1506-22:56:51,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1506-22:56:51,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1506-22:56:51,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1506-22:56:51,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1506-22:56:51,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,593808,189292,00:00:00/2-14:14:06,6090) /usr/sbin/httpd
(apache,595568,193736,00:00:00/2-14:14:06,6102) /usr/sbin/httpd
(apache,595568,193660,00:00:00/2-14:14:06,6107) /usr/sbin/httpd
(apache,595580,193716,00:00:00/2-14:14:06,6112) /usr/sbin/httpd
(apache,595580,193700,00:00:00/2-14:14:06,6113) /usr/sbin/httpd
(apache,595580,193680,00:00:00/2-14:14:06,6118) /usr/sbin/httpd
(apache,595580,193708,00:00:00/2-14:14:05,6128) /usr/sbin/httpd
(apache,595580,193704,00:00:00/2-14:14:05,6138) /usr/sbin/httpd
(apache,595580,193672,00:00:00/2-14:14:05,6147) /usr/sbin/httpd
(postfix,80944,3360,00:00:00/50:45,12563) pickup -l -t fifo -u
(root,110268,1488,00:00:00/00:00,19735) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:00,19753) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,19754) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/704-07:09:36,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/704-07:09:36,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/704-07:09:36,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,16048,2-12:13:29/704-07:09:36,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:02/2-04:07:22,23952) [flush-253:5]
(apache,595580,193616,00:00:00/1-11:09:10,32266) /usr/sbin/httpd
(apache,595580,193656,00:00:00/1-11:09:09,32270) /usr/sbin/httpd
(apache,595580,193644,00:00:00/1-11:09:09,32272) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-23 21:37

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79397063ed5a

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:38/1504-22:43:01,1) /sbin/init
(root,0,0,00:00:04/1504-22:43:01,2) [kthreadd]
(root,0,0,00:13:54/1504-22:43:01,3) [migration/0]
(root,0,0,00:12:05/1504-22:43:01,4) [ksoftirqd/0]
(root,0,0,00:00:00/1504-22:43:01,5) [stopper/0]
(root,0,0,00:03:55/1504-22:43:01,6) [watchdog/0]
(root,0,0,00:20:29/1504-22:43:01,7) [migration/1]
(root,0,0,00:00:00/1504-22:43:01,8) [stopper/1]
(root,0,0,00:06:57/1504-22:43:01,9) [ksoftirqd/1]
(root,0,0,00:03:40/1504-22:43:01,10) [watchdog/1]
(root,0,0,02:40:45/1504-22:43:01,11) [events/0]
(root,0,0,02:51:04/1504-22:43:01,12) [events/1]
(root,0,0,00:00:00/1504-22:43:01,13) [cgroup]
(root,0,0,00:00:00/1504-22:43:01,14) [khelper]
(root,0,0,00:00:00/1504-22:43:01,15) [netns]
(root,0,0,00:00:00/1504-22:43:01,16) [async/mgr]
(root,0,0,00:00:00/1504-22:43:01,17) [pm]
(root,0,0,00:00:00/1504-22:43:01,18) [xenwatch]
(root,0,0,00:00:00/1504-22:43:01,19) [xenbus]
(root,0,0,00:08:35/1504-22:43:01,20) [sync_supers]
(root,0,0,00:10:11/1504-22:43:01,21) [bdi-default]
(root,0,0,00:00:00/1504-22:43:01,22) [kintegrityd/0]
(root,0,0,00:00:00/1504-22:43:01,23) [kintegrityd/1]
(root,0,0,00:08:54/1504-22:43:01,24) [kblockd/0]
(root,0,0,00:01:42/1504-22:43:01,25) [kblockd/1]
(root,0,0,00:00:00/1504-22:43:01,26) [ata_aux]
(root,0,0,00:00:00/1504-22:43:01,27) [ata_sff/0]
(root,0,0,00:00:00/1504-22:43:01,28) [ata_sff/1]
(root,0,0,00:00:00/1504-22:43:01,29) [ksuspend_usbd]
(root,0,0,00:00:00/1504-22:43:01,30) [khubd]
(root,0,0,00:00:00/1504-22:43:01,31) [kseriod]
(root,0,0,00:00:00/1504-22:43:01,32) [md/0]
(root,0,0,00:00:00/1504-22:43:01,33) [md/1]
(root,0,0,00:00:00/1504-22:43:01,34) [md_misc/0]
(root,0,0,00:00:00/1504-22:43:01,35) [md_misc/1]
(root,0,0,00:00:00/1504-22:43:01,36) [linkwatch]
(root,0,0,00:00:49/1504-22:43:01,37) [khungtaskd]
(root,0,0,00:00:07/1504-22:43:01,38) [kswapd0]
(root,0,0,00:00:00/1504-22:43:01,39) [ksmd]
(root,0,0,00:00:00/1504-22:43:01,40) [aio/0]
(root,0,0,00:00:00/1504-22:43:01,41) [aio/1]
(root,0,0,00:00:00/1504-22:43:01,42) [crypto/0]
(root,0,0,00:00:00/1504-22:43:01,43) [crypto/1]
(root,0,0,00:00:00/1504-22:43:01,51) [kthrotld/0]
(root,0,0,00:00:00/1504-22:43:01,52) [kthrotld/1]
(root,0,0,00:00:00/1504-22:43:01,54) [khvcd]
(root,0,0,00:00:00/1504-22:43:01,55) [kpsmoused]
(root,0,0,00:00:00/1504-22:43:01,56) [usbhid_resumer]
(root,0,0,00:00:00/1504-22:43:01,57) [deferwq]
(root,0,0,00:00:00/1504-22:43:01,89) [kdmremove]
(root,0,0,00:00:00/1504-22:43:01,90) [kstriped]
(root,0,0,00:00:00/1504-22:42:56,233) [kdmflush]
(root,0,0,00:00:00/1504-22:42:56,235) [kdmflush]
(root,0,0,00:00:27/1504-22:42:43,252) [kjournald]
(root,10936,368,00:00:00/1504-22:42:23,341) /sbin/udevd -d
(root,0,0,00:00:00/1504-22:42:08,610) [kdmflush]
(root,0,0,00:00:00/1504-22:42:08,613) [kdmflush]
(root,0,0,00:00:00/1504-22:42:08,616) [kdmflush]
(root,0,0,00:00:00/1504-22:42:08,621) [kdmflush]
(root,0,0,00:00:00/1504-22:42:08,627) [kdmflush]
(root,10932,472,00:00:00/1504-22:42:08,628) /sbin/udevd -d
(root,0,0,00:00:00/1504-22:42:08,631) [kdmflush]
(root,10932,436,00:00:00/1504-22:42:08,632) /sbin/udevd -d
(root,0,0,00:16:25/1504-22:41:56,702) [flush-253:4]
(root,0,0,00:00:00/1504-22:41:47,706) [kjournald]
(root,0,0,00:00:00/1504-22:41:46,709) [xfs_mru_cache]
(root,0,0,00:11:04/1504-22:41:46,710) [xfslogd/0]
(root,0,0,00:00:00/1504-22:41:46,711) [xfslogd/1]
(root,0,0,00:15:12/1504-22:41:46,712) [xfsdatad/0]
(root,0,0,00:00:00/1504-22:41:46,713) [xfsdatad/1]
(root,0,0,00:00:00/1504-22:41:46,714) [xfsconvertd/0]
(root,0,0,00:00:00/1504-22:41:46,715) [xfsconvertd/1]
(root,0,0,00:00:12/1504-22:41:46,716) [xfsalloc/0]
(root,0,0,00:00:35/1504-22:41:46,717) [xfsalloc/1]
(root,0,0,00:00:12/1504-22:41:46,718) [xfseofblocks/0]
(root,0,0,00:00:45/1504-22:41:46,719) [xfseofblocks/1]
(root,0,0,00:00:00/1504-22:41:46,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1504-22:41:46,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1504-22:41:46,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1504-22:41:45,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1504-22:41:43,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1504-22:41:43,725) [xfs-cil/dm-2]
(root,0,0,00:01:47/1504-22:41:43,726) [xfssyncd/dm-2]
(root,0,0,08:00:43/1504-22:41:42,727) [xfsaild/dm-2]
(root,0,0,00:16:55/1504-22:41:15,728) [kjournald]
(root,0,0,00:07:26/1504-22:41:14,729) [xfsbufd/dm-5]
(root,0,0,00:06:05/1504-22:41:14,730) [xfs-cil/dm-5]
(root,0,0,00:07:04/1504-22:41:14,731) [xfssyncd/dm-5]
(root,0,0,10:48:41/1504-22:41:14,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1504-22:41:12,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1504-22:41:12,734) [xfs-cil/dm-7]
(root,0,0,00:01:45/1504-22:41:12,735) [xfssyncd/dm-7]
(root,0,0,08:03:15/1504-22:41:12,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1504-22:41:10,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1504-22:41:10,738) [xfs-cil/dm-6]
(root,0,0,00:01:48/1504-22:41:10,739) [xfssyncd/dm-6]
(root,0,0,08:03:39/1504-22:41:10,740) [xfsaild/dm-6]
(root,0,0,01:10:01/1504-22:40:51,816) [kauditd]
(root,93156,740,04:52:01/1504-22:40:37,1154) auditd
(root,249864,5540,02:44:02/1504-22:40:36,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:48/1504-22:40:35,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1504-22:40:34,1215) rpc.statd
(dbus,21580,1000,00:00:07/1504-22:40:32,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1504-22:40:30,1285) hald
(root,20400,836,00:00:00/1504-22:40:30,1286) hald-runner
(root,452700,1136,00:36:04/1504-22:40:24,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:11:01/1504-22:40:19,1375) /usr/sbin/sshd
(root,21716,804,00:24:33/1504-22:40:18,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:19/1504-22:40:14,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:29/1504-22:40:06,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1504-22:40:05,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:23/1504-22:39:55,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1504-22:39:53,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1504-22:39:53,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1504-22:39:53,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1440316,192080,9-10:03:14/1504-22:39:53,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:36/1504-22:39:33,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:45/1504-22:39:33,1759) inet_gethost 4
(root,112532,776,00:00:01/1504-22:39:32,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593808,199632,01:29:48/1504-22:39:27,1776) /usr/sbin/httpd
(root,116864,704,00:13:01/1504-22:39:26,1786) crond
(root,21104,316,00:00:01/1504-22:39:26,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1504-22:39:26,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1504-22:39:26,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1504-22:39:26,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1504-22:39:26,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1504-22:39:26,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1504-22:39:26,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1504-22:39:26,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,593808,189292,00:00:00/13:56:41,6090) /usr/sbin/httpd
(apache,595568,193556,00:00:00/13:56:41,6102) /usr/sbin/httpd
(apache,595568,193468,00:00:00/13:56:41,6107) /usr/sbin/httpd
(apache,595580,193504,00:00:00/13:56:41,6112) /usr/sbin/httpd
(apache,595580,193528,00:00:00/13:56:41,6113) /usr/sbin/httpd
(apache,595580,193456,00:00:00/13:56:41,6118) /usr/sbin/httpd
(apache,595580,193548,00:00:00/13:56:40,6128) /usr/sbin/httpd
(apache,595580,193520,00:00:00/13:56:40,6138) /usr/sbin/httpd
(apache,595580,193508,00:00:00/13:56:40,6147) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/55:48,11574) pickup -l -t fifo -u
(root,98636,3800,00:00:00/00:04,19351) sshd: unknown [priv]
(sshd,67568,1736,00:00:00/00:04,19352) sshd: unknown [net]
(root,67568,3168,00:00:00/00:03,19353) sshd: [accepted] 
(sshd,67568,1400,00:00:00/00:02,19375) sshd: [net]      
(root,110268,1488,00:00:00/00:01,19460) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,19478) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,19479) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/702-06:52:11,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/702-06:52:11,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/702-06:52:11,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,14980,2-12:02:05/702-06:52:11,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/03:49:57,23952) [flush-253:5]

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-21 21:19

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793915c7cf8a

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:30/1501-01:14:16,1) /sbin/init
(root,0,0,00:00:04/1501-01:14:16,2) [kthreadd]
(root,0,0,00:13:52/1501-01:14:16,3) [migration/0]
(root,0,0,00:12:03/1501-01:14:16,4) [ksoftirqd/0]
(root,0,0,00:00:00/1501-01:14:16,5) [stopper/0]
(root,0,0,00:03:55/1501-01:14:16,6) [watchdog/0]
(root,0,0,00:20:25/1501-01:14:16,7) [migration/1]
(root,0,0,00:00:00/1501-01:14:16,8) [stopper/1]
(root,0,0,00:06:55/1501-01:14:16,9) [ksoftirqd/1]
(root,0,0,00:03:39/1501-01:14:16,10) [watchdog/1]
(root,0,0,02:40:19/1501-01:14:16,11) [events/0]
(root,0,0,02:50:35/1501-01:14:16,12) [events/1]
(root,0,0,00:00:00/1501-01:14:16,13) [cgroup]
(root,0,0,00:00:00/1501-01:14:16,14) [khelper]
(root,0,0,00:00:00/1501-01:14:16,15) [netns]
(root,0,0,00:00:00/1501-01:14:16,16) [async/mgr]
(root,0,0,00:00:00/1501-01:14:16,17) [pm]
(root,0,0,00:00:00/1501-01:14:16,18) [xenwatch]
(root,0,0,00:00:00/1501-01:14:16,19) [xenbus]
(root,0,0,00:08:33/1501-01:14:16,20) [sync_supers]
(root,0,0,00:10:09/1501-01:14:16,21) [bdi-default]
(root,0,0,00:00:00/1501-01:14:16,22) [kintegrityd/0]
(root,0,0,00:00:00/1501-01:14:16,23) [kintegrityd/1]
(root,0,0,00:08:52/1501-01:14:16,24) [kblockd/0]
(root,0,0,00:01:42/1501-01:14:16,25) [kblockd/1]
(root,0,0,00:00:00/1501-01:14:16,26) [ata_aux]
(root,0,0,00:00:00/1501-01:14:16,27) [ata_sff/0]
(root,0,0,00:00:00/1501-01:14:16,28) [ata_sff/1]
(root,0,0,00:00:00/1501-01:14:16,29) [ksuspend_usbd]
(root,0,0,00:00:00/1501-01:14:16,30) [khubd]
(root,0,0,00:00:00/1501-01:14:16,31) [kseriod]
(root,0,0,00:00:00/1501-01:14:16,32) [md/0]
(root,0,0,00:00:00/1501-01:14:16,33) [md/1]
(root,0,0,00:00:00/1501-01:14:16,34) [md_misc/0]
(root,0,0,00:00:00/1501-01:14:16,35) [md_misc/1]
(root,0,0,00:00:00/1501-01:14:16,36) [linkwatch]
(root,0,0,00:00:48/1501-01:14:16,37) [khungtaskd]
(root,0,0,00:00:07/1501-01:14:16,38) [kswapd0]
(root,0,0,00:00:00/1501-01:14:16,39) [ksmd]
(root,0,0,00:00:00/1501-01:14:16,40) [aio/0]
(root,0,0,00:00:00/1501-01:14:16,41) [aio/1]
(root,0,0,00:00:00/1501-01:14:16,42) [crypto/0]
(root,0,0,00:00:00/1501-01:14:16,43) [crypto/1]
(root,0,0,00:00:00/1501-01:14:16,51) [kthrotld/0]
(root,0,0,00:00:00/1501-01:14:16,52) [kthrotld/1]
(root,0,0,00:00:00/1501-01:14:16,54) [khvcd]
(root,0,0,00:00:00/1501-01:14:16,55) [kpsmoused]
(root,0,0,00:00:00/1501-01:14:16,56) [usbhid_resumer]
(root,0,0,00:00:00/1501-01:14:16,57) [deferwq]
(root,0,0,00:00:00/1501-01:14:16,89) [kdmremove]
(root,0,0,00:00:00/1501-01:14:16,90) [kstriped]
(root,0,0,00:00:00/1501-01:14:11,233) [kdmflush]
(root,0,0,00:00:00/1501-01:14:11,235) [kdmflush]
(root,0,0,00:00:27/1501-01:13:58,252) [kjournald]
(root,10936,368,00:00:00/1501-01:13:38,341) /sbin/udevd -d
(root,0,0,00:00:00/1501-01:13:23,610) [kdmflush]
(root,0,0,00:00:00/1501-01:13:23,613) [kdmflush]
(root,0,0,00:00:00/1501-01:13:23,616) [kdmflush]
(root,0,0,00:00:00/1501-01:13:23,621) [kdmflush]
(root,0,0,00:00:00/1501-01:13:23,627) [kdmflush]
(root,10932,472,00:00:00/1501-01:13:23,628) /sbin/udevd -d
(root,0,0,00:00:00/1501-01:13:23,631) [kdmflush]
(root,10932,436,00:00:00/1501-01:13:23,632) /sbin/udevd -d
(root,0,0,00:16:23/1501-01:13:11,702) [flush-253:4]
(root,0,0,00:00:00/1501-01:13:02,706) [kjournald]
(root,0,0,00:00:00/1501-01:13:01,709) [xfs_mru_cache]
(root,0,0,00:11:02/1501-01:13:01,710) [xfslogd/0]
(root,0,0,00:00:00/1501-01:13:01,711) [xfslogd/1]
(root,0,0,00:15:08/1501-01:13:01,712) [xfsdatad/0]
(root,0,0,00:00:00/1501-01:13:01,713) [xfsdatad/1]
(root,0,0,00:00:00/1501-01:13:01,714) [xfsconvertd/0]
(root,0,0,00:00:00/1501-01:13:01,715) [xfsconvertd/1]
(root,0,0,00:00:12/1501-01:13:01,716) [xfsalloc/0]
(root,0,0,00:00:35/1501-01:13:01,717) [xfsalloc/1]
(root,0,0,00:00:12/1501-01:13:01,718) [xfseofblocks/0]
(root,0,0,00:00:44/1501-01:13:01,719) [xfseofblocks/1]
(root,0,0,00:00:00/1501-01:13:01,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1501-01:13:01,721) [xfs-cil/dm-3]
(root,0,0,00:01:45/1501-01:13:01,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1501-01:13:00,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1501-01:12:58,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1501-01:12:58,725) [xfs-cil/dm-2]
(root,0,0,00:01:46/1501-01:12:58,726) [xfssyncd/dm-2]
(root,0,0,07:59:22/1501-01:12:57,727) [xfsaild/dm-2]
(root,0,0,00:16:52/1501-01:12:30,728) [kjournald]
(root,0,0,00:07:25/1501-01:12:29,729) [xfsbufd/dm-5]
(root,0,0,00:06:04/1501-01:12:29,730) [xfs-cil/dm-5]
(root,0,0,00:07:03/1501-01:12:29,731) [xfssyncd/dm-5]
(root,0,0,10:46:57/1501-01:12:29,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1501-01:12:27,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1501-01:12:27,734) [xfs-cil/dm-7]
(root,0,0,00:01:44/1501-01:12:27,735) [xfssyncd/dm-7]
(root,0,0,08:01:56/1501-01:12:27,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1501-01:12:25,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1501-01:12:25,738) [xfs-cil/dm-6]
(root,0,0,00:01:48/1501-01:12:25,739) [xfssyncd/dm-6]
(root,0,0,08:02:19/1501-01:12:25,740) [xfsaild/dm-6]
(root,0,0,01:09:45/1501-01:12:06,816) [kauditd]
(root,93156,740,04:50:53/1501-01:11:52,1154) auditd
(root,249864,5540,02:43:26/1501-01:11:51,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:48/1501-01:11:50,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1501-01:11:49,1215) rpc.statd
(dbus,21580,1000,00:00:07/1501-01:11:47,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1501-01:11:45,1285) hald
(root,20400,836,00:00:00/1501-01:11:45,1286) hald-runner
(root,452700,1136,00:35:59/1501-01:11:39,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:09:35/1501-01:11:34,1375) /usr/sbin/sshd
(root,21716,804,00:24:29/1501-01:11:33,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:14/1501-01:11:29,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:28/1501-01:11:21,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1501-01:11:20,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:19/1501-01:11:10,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1501-01:11:08,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1501-01:11:08,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1501-01:11:08,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1440316,191904,9-09:27:01/1501-01:11:08,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:36/1501-01:10:48,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:44/1501-01:10:48,1759) inet_gethost 4
(root,112532,776,00:00:01/1501-01:10:47,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593016,198788,01:29:31/1501-01:10:42,1776) /usr/sbin/httpd
(root,116864,704,00:12:59/1501-01:10:41,1786) crond
(root,21104,316,00:00:01/1501-01:10:41,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1501-01:10:41,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1501-01:10:41,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1501-01:10:41,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1501-01:10:41,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1501-01:10:41,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1501-01:10:41,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1501-01:10:41,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,593016,188444,00:00:00/3-16:03:57,12893) /usr/sbin/httpd
(apache,594720,192876,00:00:00/3-16:03:57,12901) /usr/sbin/httpd
(apache,594720,192824,00:00:00/3-16:03:57,12906) /usr/sbin/httpd
(apache,594732,192828,00:00:00/3-16:03:57,12907) /usr/sbin/httpd
(apache,594732,192860,00:00:00/3-16:03:57,12912) /usr/sbin/httpd
(apache,594732,192884,00:00:00/3-16:03:57,12921) /usr/sbin/httpd
(apache,594732,192824,00:00:00/3-16:03:57,12930) /usr/sbin/httpd
(apache,594732,192832,00:00:00/3-16:03:57,12939) /usr/sbin/httpd
(apache,594732,192848,00:00:00/3-16:03:57,12949) /usr/sbin/httpd
(root,0,0,00:00:06/7-13:51:05,15144) [flush-253:5]
(apache,594732,192768,00:00:00/2-18:22:47,17366) /usr/sbin/httpd
(apache,594732,192820,00:00:00/2-18:22:40,17372) /usr/sbin/httpd
(apache,594732,192832,00:00:00/2-18:22:37,17374) /usr/sbin/httpd
(apache,594732,192836,00:00:00/2-18:22:31,17378) /usr/sbin/httpd
(apache,594732,192760,00:00:00/2-18:22:30,17379) /usr/sbin/httpd
(apache,594732,192760,00:00:00/2-18:22:30,17380) /usr/sbin/httpd
(apache,594732,192828,00:00:00/2-18:22:23,17385) /usr/sbin/httpd
(apache,594732,192800,00:00:00/2-18:22:04,17392) /usr/sbin/httpd
(postfix,80944,3364,00:00:00/51:53,18424) pickup -l -t fifo -u
(root,108468,1060,00:00:00/698-09:23:26,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/698-09:23:26,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/698-09:23:26,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15680,2-11:39:46/698-09:23:26,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,101428,4388,00:00:00/00:10,25067) sshd: root [priv]
(sshd,67568,1644,00:00:00/00:10,25068) sshd: root [net] 
(root,98636,3780,00:00:00/00:06,25069) sshd: zabbix [priv]
(sshd,67568,1656,00:00:00/00:05,25070) sshd: zabbix [net]
(root,110268,1492,00:00:00/00:01,25135) /bin/bash /usr/bin/check_mk_agent
(root,13368,972,00:00:00/00:01,25153) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,25154) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-17 23:51

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939d62e0ab8

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1300,00:32:28/1500-00:23:21,1) /sbin/init
(root,0,0,00:00:04/1500-00:23:21,2) [kthreadd]
(root,0,0,00:13:51/1500-00:23:21,3) [migration/0]
(root,0,0,00:12:02/1500-00:23:21,4) [ksoftirqd/0]
(root,0,0,00:00:00/1500-00:23:21,5) [stopper/0]
(root,0,0,00:03:54/1500-00:23:21,6) [watchdog/0]
(root,0,0,00:20:24/1500-00:23:21,7) [migration/1]
(root,0,0,00:00:00/1500-00:23:21,8) [stopper/1]
(root,0,0,00:06:55/1500-00:23:21,9) [ksoftirqd/1]
(root,0,0,00:03:39/1500-00:23:21,10) [watchdog/1]
(root,0,0,02:40:13/1500-00:23:21,11) [events/0]
(root,0,0,02:50:28/1500-00:23:21,12) [events/1]
(root,0,0,00:00:00/1500-00:23:21,13) [cgroup]
(root,0,0,00:00:00/1500-00:23:21,14) [khelper]
(root,0,0,00:00:00/1500-00:23:21,15) [netns]
(root,0,0,00:00:00/1500-00:23:21,16) [async/mgr]
(root,0,0,00:00:00/1500-00:23:21,17) [pm]
(root,0,0,00:00:00/1500-00:23:21,18) [xenwatch]
(root,0,0,00:00:00/1500-00:23:21,19) [xenbus]
(root,0,0,00:08:33/1500-00:23:21,20) [sync_supers]
(root,0,0,00:10:09/1500-00:23:21,21) [bdi-default]
(root,0,0,00:00:00/1500-00:23:21,22) [kintegrityd/0]
(root,0,0,00:00:00/1500-00:23:21,23) [kintegrityd/1]
(root,0,0,00:08:52/1500-00:23:21,24) [kblockd/0]
(root,0,0,00:01:41/1500-00:23:21,25) [kblockd/1]
(root,0,0,00:00:00/1500-00:23:21,26) [ata_aux]
(root,0,0,00:00:00/1500-00:23:21,27) [ata_sff/0]
(root,0,0,00:00:00/1500-00:23:21,28) [ata_sff/1]
(root,0,0,00:00:00/1500-00:23:21,29) [ksuspend_usbd]
(root,0,0,00:00:00/1500-00:23:21,30) [khubd]
(root,0,0,00:00:00/1500-00:23:21,31) [kseriod]
(root,0,0,00:00:00/1500-00:23:21,32) [md/0]
(root,0,0,00:00:00/1500-00:23:21,33) [md/1]
(root,0,0,00:00:00/1500-00:23:21,34) [md_misc/0]
(root,0,0,00:00:00/1500-00:23:21,35) [md_misc/1]
(root,0,0,00:00:00/1500-00:23:21,36) [linkwatch]
(root,0,0,00:00:48/1500-00:23:21,37) [khungtaskd]
(root,0,0,00:00:07/1500-00:23:21,38) [kswapd0]
(root,0,0,00:00:00/1500-00:23:21,39) [ksmd]
(root,0,0,00:00:00/1500-00:23:21,40) [aio/0]
(root,0,0,00:00:00/1500-00:23:21,41) [aio/1]
(root,0,0,00:00:00/1500-00:23:21,42) [crypto/0]
(root,0,0,00:00:00/1500-00:23:21,43) [crypto/1]
(root,0,0,00:00:00/1500-00:23:21,51) [kthrotld/0]
(root,0,0,00:00:00/1500-00:23:21,52) [kthrotld/1]
(root,0,0,00:00:00/1500-00:23:21,54) [khvcd]
(root,0,0,00:00:00/1500-00:23:21,55) [kpsmoused]
(root,0,0,00:00:00/1500-00:23:21,56) [usbhid_resumer]
(root,0,0,00:00:00/1500-00:23:21,57) [deferwq]
(root,0,0,00:00:00/1500-00:23:21,89) [kdmremove]
(root,0,0,00:00:00/1500-00:23:21,90) [kstriped]
(root,0,0,00:00:00/1500-00:23:16,233) [kdmflush]
(root,0,0,00:00:00/1500-00:23:16,235) [kdmflush]
(root,0,0,00:00:27/1500-00:23:03,252) [kjournald]
(root,10936,368,00:00:00/1500-00:22:43,341) /sbin/udevd -d
(root,0,0,00:00:00/1500-00:22:28,610) [kdmflush]
(root,0,0,00:00:00/1500-00:22:28,613) [kdmflush]
(root,0,0,00:00:00/1500-00:22:28,616) [kdmflush]
(root,0,0,00:00:00/1500-00:22:28,621) [kdmflush]
(root,0,0,00:00:00/1500-00:22:28,627) [kdmflush]
(root,10932,472,00:00:00/1500-00:22:28,628) /sbin/udevd -d
(root,0,0,00:00:00/1500-00:22:28,631) [kdmflush]
(root,10932,436,00:00:00/1500-00:22:28,632) /sbin/udevd -d
(root,0,0,00:16:22/1500-00:22:16,702) [flush-253:4]
(root,0,0,00:00:00/1500-00:22:07,706) [kjournald]
(root,0,0,00:00:00/1500-00:22:06,709) [xfs_mru_cache]
(root,0,0,00:11:01/1500-00:22:06,710) [xfslogd/0]
(root,0,0,00:00:00/1500-00:22:06,711) [xfslogd/1]
(root,0,0,00:15:07/1500-00:22:06,712) [xfsdatad/0]
(root,0,0,00:00:00/1500-00:22:06,713) [xfsdatad/1]
(root,0,0,00:00:00/1500-00:22:06,714) [xfsconvertd/0]
(root,0,0,00:00:00/1500-00:22:06,715) [xfsconvertd/1]
(root,0,0,00:00:12/1500-00:22:06,716) [xfsalloc/0]
(root,0,0,00:00:35/1500-00:22:06,717) [xfsalloc/1]
(root,0,0,00:00:12/1500-00:22:06,718) [xfseofblocks/0]
(root,0,0,00:00:44/1500-00:22:06,719) [xfseofblocks/1]
(root,0,0,00:00:00/1500-00:22:06,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1500-00:22:06,721) [xfs-cil/dm-3]
(root,0,0,00:01:44/1500-00:22:06,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1500-00:22:05,723) [xfsaild/dm-3]
(root,0,0,00:00:01/1500-00:22:03,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1500-00:22:03,725) [xfs-cil/dm-2]
(root,0,0,00:01:46/1500-00:22:03,726) [xfssyncd/dm-2]
(root,0,0,07:59:03/1500-00:22:02,727) [xfsaild/dm-2]
(root,0,0,00:16:51/1500-00:21:35,728) [kjournald]
(root,0,0,00:07:25/1500-00:21:34,729) [xfsbufd/dm-5]
(root,0,0,00:06:04/1500-00:21:34,730) [xfs-cil/dm-5]
(root,0,0,00:07:03/1500-00:21:34,731) [xfssyncd/dm-5]
(root,0,0,10:46:30/1500-00:21:34,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1500-00:21:32,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1500-00:21:32,734) [xfs-cil/dm-7]
(root,0,0,00:01:44/1500-00:21:32,735) [xfssyncd/dm-7]
(root,0,0,08:01:36/1500-00:21:32,736) [xfsaild/dm-7]
(root,0,0,00:00:01/1500-00:21:30,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1500-00:21:30,738) [xfs-cil/dm-6]
(root,0,0,00:01:48/1500-00:21:30,739) [xfssyncd/dm-6]
(root,0,0,08:01:59/1500-00:21:30,740) [xfsaild/dm-6]
(root,0,0,01:09:41/1500-00:21:11,816) [kauditd]
(root,93156,740,04:50:34/1500-00:20:57,1154) auditd
(root,249864,5540,02:43:15/1500-00:20:56,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19104,996,00:06:47/1500-00:20:55,1195) rpcbind
(rpcuser,23404,1080,00:00:00/1500-00:20:54,1215) rpc.statd
(dbus,21580,1000,00:00:07/1500-00:20:52,1248) dbus-daemon --system
(haldaemon,38764,1472,00:00:02/1500-00:20:50,1285) hald
(root,20400,836,00:00:00/1500-00:20:50,1286) hald-runner
(root,452700,1136,00:35:57/1500-00:20:44,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,06:09:12/1500-00:20:39,1375) /usr/sbin/sshd
(root,21716,804,00:24:28/1500-00:20:38,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1464,00:30:13/1500-00:20:34,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,1988,00:10:27/1500-00:20:26,1548) /usr/libexec/postfix/master
(postfix,81108,1928,00:01:37/1500-00:20:25,1555) qmgr -l -t fifo -u
(rabbitmq,10952,616,00:24:18/1500-00:20:15,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1500-00:20:13,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1500-00:20:13,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1396,00:00:00/1500-00:20:13,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1439340,191976,9-09:17:03/1500-00:20:13,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,440,00:02:36/1500-00:19:53,1758) inet_gethost 4
(rabbitmq,17120,804,00:04:44/1500-00:19:53,1759) inet_gethost 4
(root,112532,776,00:00:01/1500-00:19:52,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,593016,198788,01:29:28/1500-00:19:47,1776) /usr/sbin/httpd
(root,116864,704,00:12:59/1500-00:19:46,1786) crond
(root,21104,316,00:00:01/1500-00:19:46,1799) /usr/sbin/atd
(root,4064,464,00:00:00/1500-00:19:46,1819) /sbin/mingetty /dev/tty1
(root,4064,464,00:00:00/1500-00:19:46,1821) /sbin/mingetty /dev/tty2
(root,4064,464,00:00:00/1500-00:19:46,1823) /sbin/mingetty /dev/tty3
(root,4064,464,00:00:00/1500-00:19:46,1825) /sbin/mingetty /dev/tty4
(root,4064,464,00:00:00/1500-00:19:46,1827) /sbin/mingetty /dev/tty5
(root,4064,464,00:00:00/1500-00:19:46,1829) /sbin/mingetty /dev/tty6
(root,4080,520,00:00:00/1500-00:19:46,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3368,00:00:00/01:02:14,6192) pickup -l -t fifo -u
(apache,593016,188444,00:00:00/2-15:13:02,12893) /usr/sbin/httpd
(apache,594720,192864,00:00:00/2-15:13:02,12901) /usr/sbin/httpd
(apache,594720,192792,00:00:00/2-15:13:02,12906) /usr/sbin/httpd
(apache,594732,192828,00:00:00/2-15:13:02,12907) /usr/sbin/httpd
(apache,594732,192844,00:00:00/2-15:13:02,12912) /usr/sbin/httpd
(apache,594732,192860,00:00:00/2-15:13:02,12921) /usr/sbin/httpd
(apache,594732,192820,00:00:00/2-15:13:02,12930) /usr/sbin/httpd
(apache,594732,192808,00:00:00/2-15:13:02,12939) /usr/sbin/httpd
(apache,594732,192820,00:00:00/2-15:13:02,12949) /usr/sbin/httpd
(root,67568,3244,00:00:00/00:13,14167) sshd: [accepted] 
(sshd,67568,1568,00:00:00/00:13,14168) sshd: [net]      
(root,110268,1492,00:00:00/00:01,14248) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,14266) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,14267) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:05/6-13:00:10,15144) [flush-253:5]
(apache,594732,192748,00:00:00/1-17:31:52,17366) /usr/sbin/httpd
(apache,594732,192804,00:00:00/1-17:31:45,17372) /usr/sbin/httpd
(apache,594732,192800,00:00:00/1-17:31:42,17374) /usr/sbin/httpd
(apache,594732,192828,00:00:00/1-17:31:36,17378) /usr/sbin/httpd
(apache,594732,192740,00:00:00/1-17:31:35,17379) /usr/sbin/httpd
(apache,594732,192736,00:00:00/1-17:31:35,17380) /usr/sbin/httpd
(apache,594732,192792,00:00:00/1-17:31:28,17385) /usr/sbin/httpd
(apache,594732,192780,00:00:00/1-17:31:09,17392) /usr/sbin/httpd
(root,108468,1060,00:00:00/697-08:32:31,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1348,00:00:00/697-08:32:31,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/697-08:32:31,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521740,15568,2-11:37:23/697-08:32:31,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2024-07-16 23:00

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793996622b26

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1316,00:14:18/1039-23:20:01,1) /sbin/init
(root,0,0,00:00:03/1039-23:20:01,2) [kthreadd]
(root,0,0,00:09:34/1039-23:20:01,3) [migration/0]
(root,0,0,00:06:55/1039-23:20:01,4) [ksoftirqd/0]
(root,0,0,00:00:00/1039-23:20:01,5) [stopper/0]
(root,0,0,00:02:41/1039-23:20:01,6) [watchdog/0]
(root,0,0,00:12:45/1039-23:20:01,7) [migration/1]
(root,0,0,00:00:00/1039-23:20:01,8) [stopper/1]
(root,0,0,00:04:00/1039-23:20:01,9) [ksoftirqd/1]
(root,0,0,00:02:32/1039-23:20:01,10) [watchdog/1]
(root,0,0,01:50:22/1039-23:20:01,11) [events/0]
(root,0,0,01:54:37/1039-23:20:01,12) [events/1]
(root,0,0,00:00:00/1039-23:20:01,13) [cgroup]
(root,0,0,00:00:00/1039-23:20:01,14) [khelper]
(root,0,0,00:00:00/1039-23:20:01,15) [netns]
(root,0,0,00:00:00/1039-23:20:01,16) [async/mgr]
(root,0,0,00:00:00/1039-23:20:01,17) [pm]
(root,0,0,00:00:00/1039-23:20:01,18) [xenwatch]
(root,0,0,00:00:00/1039-23:20:01,19) [xenbus]
(root,0,0,00:05:52/1039-23:20:01,20) [sync_supers]
(root,0,0,00:07:01/1039-23:20:01,21) [bdi-default]
(root,0,0,00:00:00/1039-23:20:01,22) [kintegrityd/0]
(root,0,0,00:00:00/1039-23:20:01,23) [kintegrityd/1]
(root,0,0,00:05:41/1039-23:20:01,24) [kblockd/0]
(root,0,0,00:01:08/1039-23:20:01,25) [kblockd/1]
(root,0,0,00:00:00/1039-23:20:01,26) [ata_aux]
(root,0,0,00:00:00/1039-23:20:01,27) [ata_sff/0]
(root,0,0,00:00:00/1039-23:20:01,28) [ata_sff/1]
(root,0,0,00:00:00/1039-23:20:01,29) [ksuspend_usbd]
(root,0,0,00:00:00/1039-23:20:01,30) [khubd]
(root,0,0,00:00:00/1039-23:20:01,31) [kseriod]
(root,0,0,00:00:00/1039-23:20:01,32) [md/0]
(root,0,0,00:00:00/1039-23:20:01,33) [md/1]
(root,0,0,00:00:00/1039-23:20:01,34) [md_misc/0]
(root,0,0,00:00:00/1039-23:20:01,35) [md_misc/1]
(root,0,0,00:00:00/1039-23:20:01,36) [linkwatch]
(root,0,0,00:00:33/1039-23:20:01,37) [khungtaskd]
(root,0,0,00:00:01/1039-23:20:01,38) [kswapd0]
(root,0,0,00:00:00/1039-23:20:01,39) [ksmd]
(root,0,0,00:00:00/1039-23:20:01,40) [aio/0]
(root,0,0,00:00:00/1039-23:20:01,41) [aio/1]
(root,0,0,00:00:00/1039-23:20:01,42) [crypto/0]
(root,0,0,00:00:00/1039-23:20:01,43) [crypto/1]
(root,0,0,00:00:00/1039-23:20:01,51) [kthrotld/0]
(root,0,0,00:00:00/1039-23:20:01,52) [kthrotld/1]
(root,0,0,00:00:00/1039-23:20:01,54) [khvcd]
(root,0,0,00:00:00/1039-23:20:01,55) [kpsmoused]
(root,0,0,00:00:00/1039-23:20:01,56) [usbhid_resumer]
(root,0,0,00:00:00/1039-23:20:01,57) [deferwq]
(root,0,0,00:00:00/1039-23:20:01,89) [kdmremove]
(root,0,0,00:00:00/1039-23:20:01,90) [kstriped]
(root,0,0,00:00:00/1039-23:19:56,233) [kdmflush]
(root,0,0,00:00:00/1039-23:19:56,235) [kdmflush]
(root,0,0,00:00:18/1039-23:19:43,252) [kjournald]
(root,10936,432,00:00:00/1039-23:19:23,341) /sbin/udevd -d
(root,0,0,00:00:00/1039-23:19:08,610) [kdmflush]
(root,0,0,00:00:00/1039-23:19:08,613) [kdmflush]
(root,0,0,00:00:00/1039-23:19:08,616) [kdmflush]
(root,0,0,00:00:00/1039-23:19:08,621) [kdmflush]
(root,0,0,00:00:00/1039-23:19:08,627) [kdmflush]
(root,10932,544,00:00:00/1039-23:19:08,628) /sbin/udevd -d
(root,0,0,00:00:00/1039-23:19:08,631) [kdmflush]
(root,10932,508,00:00:00/1039-23:19:08,632) /sbin/udevd -d
(root,0,0,00:11:15/1039-23:18:56,702) [flush-253:4]
(root,0,0,00:00:00/1039-23:18:47,706) [kjournald]
(root,0,0,00:00:00/1039-23:18:46,709) [xfs_mru_cache]
(root,0,0,00:06:12/1039-23:18:46,710) [xfslogd/0]
(root,0,0,00:00:00/1039-23:18:46,711) [xfslogd/1]
(root,0,0,00:07:59/1039-23:18:46,712) [xfsdatad/0]
(root,0,0,00:00:00/1039-23:18:46,713) [xfsdatad/1]
(root,0,0,00:00:00/1039-23:18:46,714) [xfsconvertd/0]
(root,0,0,00:00:00/1039-23:18:46,715) [xfsconvertd/1]
(root,0,0,00:00:09/1039-23:18:46,716) [xfsalloc/0]
(root,0,0,00:00:23/1039-23:18:46,717) [xfsalloc/1]
(root,0,0,00:00:08/1039-23:18:46,718) [xfseofblocks/0]
(root,0,0,00:00:33/1039-23:18:46,719) [xfseofblocks/1]
(root,0,0,00:00:00/1039-23:18:46,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1039-23:18:46,721) [xfs-cil/dm-3]
(root,0,0,00:01:12/1039-23:18:46,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1039-23:18:45,723) [xfsaild/dm-3]
(root,0,0,00:00:00/1039-23:18:43,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1039-23:18:43,725) [xfs-cil/dm-2]
(root,0,0,00:01:13/1039-23:18:43,726) [xfssyncd/dm-2]
(root,0,0,05:22:30/1039-23:18:42,727) [xfsaild/dm-2]
(root,0,0,00:11:29/1039-23:18:15,728) [kjournald]
(root,0,0,00:05:17/1039-23:18:14,729) [xfsbufd/dm-5]
(root,0,0,00:03:21/1039-23:18:14,730) [xfs-cil/dm-5]
(root,0,0,00:04:53/1039-23:18:14,731) [xfssyncd/dm-5]
(root,0,0,07:21:36/1039-23:18:14,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1039-23:18:12,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1039-23:18:12,734) [xfs-cil/dm-7]
(root,0,0,00:01:12/1039-23:18:12,735) [xfssyncd/dm-7]
(root,0,0,05:24:16/1039-23:18:12,736) [xfsaild/dm-7]
(root,0,0,00:00:00/1039-23:18:10,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1039-23:18:10,738) [xfs-cil/dm-6]
(root,0,0,00:01:14/1039-23:18:10,739) [xfssyncd/dm-6]
(root,0,0,05:24:47/1039-23:18:10,740) [xfsaild/dm-6]
(root,0,0,00:32:54/1039-23:17:51,816) [kauditd]
(root,93156,748,02:15:40/1039-23:17:37,1154) auditd
(root,249864,5532,01:20:07/1039-23:17:36,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:34/1039-23:17:35,1195) rpcbind
(rpcuser,23404,1116,00:00:00/1039-23:17:34,1215) rpc.statd
(dbus,21580,1024,00:00:05/1039-23:17:32,1248) dbus-daemon --system
(haldaemon,38764,1788,00:00:01/1039-23:17:30,1285) hald
(root,20400,940,00:00:00/1039-23:17:30,1286) hald-runner
(root,452700,1172,00:24:49/1039-23:17:24,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:49:13/1039-23:17:19,1375) /usr/sbin/sshd
(root,21716,816,00:16:59/1039-23:17:18,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1692,00:20:54/1039-23:17:14,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2524,00:07:13/1039-23:17:06,1548) /usr/libexec/postfix/master
(postfix,81108,2468,00:01:07/1039-23:17:05,1555) qmgr -l -t fifo -u
(rabbitmq,10832,588,00:16:47/1039-23:16:55,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1039-23:16:53,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1039-23:16:53,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/1039-23:16:53,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1427668,333156,6-11:25:04/1039-23:16:53,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:48/1039-23:16:33,1758) inet_gethost 4
(rabbitmq,17120,860,00:03:16/1039-23:16:33,1759) inet_gethost 4
(root,112532,952,00:00:00/1039-23:16:32,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,537096,145128,00:59:21/1039-23:16:27,1776) /usr/sbin/httpd
(root,116864,1220,00:09:02/1039-23:16:26,1786) crond
(root,21104,484,00:00:01/1039-23:16:26,1799) /usr/sbin/atd
(root,4064,540,00:00:00/1039-23:16:26,1819) /sbin/mingetty /dev/tty1
(root,4064,540,00:00:00/1039-23:16:26,1821) /sbin/mingetty /dev/tty2
(root,4064,536,00:00:00/1039-23:16:26,1823) /sbin/mingetty /dev/tty3
(root,4064,536,00:00:00/1039-23:16:26,1825) /sbin/mingetty /dev/tty4
(root,4064,536,00:00:00/1039-23:16:26,1827) /sbin/mingetty /dev/tty5
(root,4064,536,00:00:00/1039-23:16:26,1829) /sbin/mingetty /dev/tty6
(root,4080,596,00:00:00/1039-23:16:26,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3364,00:00:00/01:10:15,4089) pickup -l -t fifo -u
(root,110268,1488,00:00:00/00:01,12747) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,12765) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,12766) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/237-07:29:11,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/237-07:29:11,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/237-07:29:11,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521336,18092,20:15:39/237-07:29:11,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,538900,139188,00:00:00/4-10:46:10,20984) /usr/sbin/httpd
(root,0,0,00:00:00/03:08:28,22714) [flush-253:5]
(apache,537096,134536,00:00:00/4-14:11:33,29087) /usr/sbin/httpd
(apache,538900,139304,00:00:00/4-14:11:33,29092) /usr/sbin/httpd
(apache,538892,139316,00:00:00/4-14:11:33,29093) /usr/sbin/httpd
(apache,538892,139284,00:00:00/4-14:11:32,29094) /usr/sbin/httpd
(apache,538900,139256,00:00:00/4-14:11:32,29097) /usr/sbin/httpd
(apache,538900,139272,00:00:00/4-14:11:32,29102) /usr/sbin/httpd
(apache,538900,139268,00:00:00/4-14:11:32,29107) /usr/sbin/httpd
(apache,538892,139264,00:00:00/4-14:11:32,29114) /usr/sbin/httpd
(apache,538900,139240,00:00:00/4-14:11:32,29119) /usr/sbin/httpd
(apache,538900,139168,00:00:00/3-13:27:41,31555) /usr/sbin/httpd
(apache,538900,139256,00:00:00/3-13:27:39,31570) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-04-13 21:56

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939ba7c971b

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:14:00/1015-14:33:07,1) /sbin/init
(root,0,0,00:00:03/1015-14:33:07,2) [kthreadd]
(root,0,0,00:09:21/1015-14:33:07,3) [migration/0]
(root,0,0,00:06:40/1015-14:33:07,4) [ksoftirqd/0]
(root,0,0,00:00:00/1015-14:33:07,5) [stopper/0]
(root,0,0,00:02:37/1015-14:33:07,6) [watchdog/0]
(root,0,0,00:12:27/1015-14:33:07,7) [migration/1]
(root,0,0,00:00:00/1015-14:33:07,8) [stopper/1]
(root,0,0,00:03:52/1015-14:33:07,9) [ksoftirqd/1]
(root,0,0,00:02:28/1015-14:33:07,10) [watchdog/1]
(root,0,0,01:47:44/1015-14:33:07,11) [events/0]
(root,0,0,01:51:50/1015-14:33:07,12) [events/1]
(root,0,0,00:00:00/1015-14:33:07,13) [cgroup]
(root,0,0,00:00:00/1015-14:33:07,14) [khelper]
(root,0,0,00:00:00/1015-14:33:07,15) [netns]
(root,0,0,00:00:00/1015-14:33:07,16) [async/mgr]
(root,0,0,00:00:00/1015-14:33:07,17) [pm]
(root,0,0,00:00:00/1015-14:33:07,18) [xenwatch]
(root,0,0,00:00:00/1015-14:33:07,19) [xenbus]
(root,0,0,00:05:43/1015-14:33:07,20) [sync_supers]
(root,0,0,00:06:51/1015-14:33:07,21) [bdi-default]
(root,0,0,00:00:00/1015-14:33:07,22) [kintegrityd/0]
(root,0,0,00:00:00/1015-14:33:07,23) [kintegrityd/1]
(root,0,0,00:05:33/1015-14:33:07,24) [kblockd/0]
(root,0,0,00:01:07/1015-14:33:07,25) [kblockd/1]
(root,0,0,00:00:00/1015-14:33:07,26) [ata_aux]
(root,0,0,00:00:00/1015-14:33:07,27) [ata_sff/0]
(root,0,0,00:00:00/1015-14:33:07,28) [ata_sff/1]
(root,0,0,00:00:00/1015-14:33:07,29) [ksuspend_usbd]
(root,0,0,00:00:00/1015-14:33:07,30) [khubd]
(root,0,0,00:00:00/1015-14:33:07,31) [kseriod]
(root,0,0,00:00:00/1015-14:33:07,32) [md/0]
(root,0,0,00:00:00/1015-14:33:07,33) [md/1]
(root,0,0,00:00:00/1015-14:33:07,34) [md_misc/0]
(root,0,0,00:00:00/1015-14:33:07,35) [md_misc/1]
(root,0,0,00:00:00/1015-14:33:07,36) [linkwatch]
(root,0,0,00:00:32/1015-14:33:07,37) [khungtaskd]
(root,0,0,00:00:01/1015-14:33:07,38) [kswapd0]
(root,0,0,00:00:00/1015-14:33:07,39) [ksmd]
(root,0,0,00:00:00/1015-14:33:07,40) [aio/0]
(root,0,0,00:00:00/1015-14:33:07,41) [aio/1]
(root,0,0,00:00:00/1015-14:33:07,42) [crypto/0]
(root,0,0,00:00:00/1015-14:33:07,43) [crypto/1]
(root,0,0,00:00:00/1015-14:33:07,51) [kthrotld/0]
(root,0,0,00:00:00/1015-14:33:07,52) [kthrotld/1]
(root,0,0,00:00:00/1015-14:33:07,54) [khvcd]
(root,0,0,00:00:00/1015-14:33:07,55) [kpsmoused]
(root,0,0,00:00:00/1015-14:33:07,56) [usbhid_resumer]
(root,0,0,00:00:00/1015-14:33:07,57) [deferwq]
(root,0,0,00:00:00/1015-14:33:07,89) [kdmremove]
(root,0,0,00:00:00/1015-14:33:07,90) [kstriped]
(root,0,0,00:00:00/1015-14:33:02,233) [kdmflush]
(root,0,0,00:00:00/1015-14:33:02,235) [kdmflush]
(root,0,0,00:00:17/1015-14:32:49,252) [kjournald]
(root,0,0,00:00:01/1-18:42:52,315) [flush-253:5]
(root,10936,436,00:00:00/1015-14:32:29,341) /sbin/udevd -d
(root,0,0,00:00:00/1015-14:32:14,610) [kdmflush]
(root,0,0,00:00:00/1015-14:32:14,613) [kdmflush]
(root,0,0,00:00:00/1015-14:32:14,616) [kdmflush]
(root,0,0,00:00:00/1015-14:32:14,621) [kdmflush]
(root,0,0,00:00:00/1015-14:32:14,627) [kdmflush]
(root,10932,556,00:00:00/1015-14:32:14,628) /sbin/udevd -d
(root,0,0,00:00:00/1015-14:32:14,631) [kdmflush]
(root,10932,520,00:00:00/1015-14:32:14,632) /sbin/udevd -d
(root,0,0,00:10:59/1015-14:32:02,702) [flush-253:4]
(root,0,0,00:00:00/1015-14:31:53,706) [kjournald]
(root,0,0,00:00:00/1015-14:31:52,709) [xfs_mru_cache]
(root,0,0,00:06:04/1015-14:31:52,710) [xfslogd/0]
(root,0,0,00:00:00/1015-14:31:52,711) [xfslogd/1]
(root,0,0,00:07:50/1015-14:31:52,712) [xfsdatad/0]
(root,0,0,00:00:00/1015-14:31:52,713) [xfsdatad/1]
(root,0,0,00:00:00/1015-14:31:52,714) [xfsconvertd/0]
(root,0,0,00:00:00/1015-14:31:52,715) [xfsconvertd/1]
(root,0,0,00:00:08/1015-14:31:52,716) [xfsalloc/0]
(root,0,0,00:00:23/1015-14:31:52,717) [xfsalloc/1]
(root,0,0,00:00:08/1015-14:31:52,718) [xfseofblocks/0]
(root,0,0,00:00:32/1015-14:31:52,719) [xfseofblocks/1]
(root,0,0,00:00:00/1015-14:31:52,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/1015-14:31:52,721) [xfs-cil/dm-3]
(root,0,0,00:01:11/1015-14:31:52,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/1015-14:31:51,723) [xfsaild/dm-3]
(root,0,0,00:00:00/1015-14:31:49,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/1015-14:31:49,725) [xfs-cil/dm-2]
(root,0,0,00:01:11/1015-14:31:49,726) [xfssyncd/dm-2]
(root,0,0,05:14:05/1015-14:31:48,727) [xfsaild/dm-2]
(root,0,0,00:11:13/1015-14:31:21,728) [kjournald]
(root,0,0,00:05:09/1015-14:31:20,729) [xfsbufd/dm-5]
(root,0,0,00:03:17/1015-14:31:20,730) [xfs-cil/dm-5]
(root,0,0,00:04:46/1015-14:31:20,731) [xfssyncd/dm-5]
(root,0,0,07:11:09/1015-14:31:20,732) [xfsaild/dm-5]
(root,0,0,00:00:02/1015-14:31:18,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/1015-14:31:18,734) [xfs-cil/dm-7]
(root,0,0,00:01:10/1015-14:31:18,735) [xfssyncd/dm-7]
(root,0,0,05:15:52/1015-14:31:18,736) [xfsaild/dm-7]
(root,0,0,00:00:00/1015-14:31:16,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/1015-14:31:16,738) [xfs-cil/dm-6]
(root,0,0,00:01:13/1015-14:31:16,739) [xfssyncd/dm-6]
(root,0,0,05:16:25/1015-14:31:16,740) [xfsaild/dm-6]
(root,0,0,00:32:16/1015-14:30:57,816) [kauditd]
(root,93156,756,02:13:02/1015-14:30:43,1154) auditd
(root,249864,5716,01:18:36/1015-14:30:42,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:30/1015-14:30:41,1195) rpcbind
(rpcuser,23404,1156,00:00:00/1015-14:30:40,1215) rpc.statd
(dbus,21580,1040,00:00:05/1015-14:30:38,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/1015-14:30:36,1285) hald
(root,20400,956,00:00:00/1015-14:30:36,1286) hald-runner
(root,452700,1544,00:24:14/1015-14:30:30,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:46:05/1015-14:30:25,1375) /usr/sbin/sshd
(root,21716,848,00:16:36/1015-14:30:24,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:20:25/1015-14:30:20,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:07:03/1015-14:30:12,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:05/1015-14:30:11,1555) qmgr -l -t fifo -u
(rabbitmq,10832,588,00:16:23/1015-14:30:01,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/1015-14:29:59,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/1015-14:29:59,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/1015-14:29:59,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1426044,332876,6-07:46:55/1015-14:29:59,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:45/1015-14:29:39,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:11/1015-14:29:39,1759) inet_gethost 4
(root,112532,964,00:00:00/1015-14:29:38,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,534588,142624,00:57:50/1015-14:29:33,1776) /usr/sbin/httpd
(root,116864,1220,00:08:49/1015-14:29:32,1786) crond
(root,21104,484,00:00:01/1015-14:29:32,1799) /usr/sbin/atd
(root,4064,544,00:00:00/1015-14:29:32,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/1015-14:29:32,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/1015-14:29:32,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/1015-14:29:32,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/1015-14:29:32,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/1015-14:29:32,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/1015-14:29:32,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3368,00:00:00/13:35,3069) pickup -l -t fifo -u
(apache,534588,132000,00:00:00/1-05:25:49,4220) /usr/sbin/httpd
(apache,536364,136252,00:00:00/1-05:25:49,4225) /usr/sbin/httpd
(apache,536356,136288,00:00:00/1-05:25:49,4236) /usr/sbin/httpd
(apache,536372,136256,00:00:00/1-05:25:49,4241) /usr/sbin/httpd
(apache,536356,136320,00:00:00/1-05:25:49,4248) /usr/sbin/httpd
(apache,536356,136276,00:00:00/1-05:25:49,4255) /usr/sbin/httpd
(apache,536364,136284,00:00:00/1-05:25:49,4261) /usr/sbin/httpd
(apache,536364,136336,00:00:00/1-05:25:49,4268) /usr/sbin/httpd
(apache,536364,136264,00:00:00/1-05:25:49,4273) /usr/sbin/httpd
(root,101428,4396,00:00:00/00:05,4673) sshd: root [priv]
(sshd,67568,1648,00:00:00/00:05,4674) sshd: root [net] 
(root,110268,1492,00:00:00/00:01,4900) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,4918) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,4919) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/212-22:42:17,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/212-22:42:17,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/212-22:42:17,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521336,17568,18:11:41/212-22:42:17,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,536364,136256,00:00:00/22:55:37,23122) /usr/sbin/httpd
(apache,536364,136236,00:00:00/22:55:36,23126) /usr/sbin/httpd
(apache,536364,136244,00:00:00/22:55:36,23127) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-03-20 13:10

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c79393beae2f3

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:13:42/994-15:07:32,1) /sbin/init
(root,0,0,00:00:03/994-15:07:32,2) [kthreadd]
(root,0,0,00:09:09/994-15:07:32,3) [migration/0]
(root,0,0,00:06:26/994-15:07:32,4) [ksoftirqd/0]
(root,0,0,00:00:00/994-15:07:32,5) [stopper/0]
(root,0,0,00:02:34/994-15:07:32,6) [watchdog/0]
(root,0,0,00:12:11/994-15:07:32,7) [migration/1]
(root,0,0,00:00:00/994-15:07:32,8) [stopper/1]
(root,0,0,00:03:45/994-15:07:32,9) [ksoftirqd/1]
(root,0,0,00:02:25/994-15:07:32,10) [watchdog/1]
(root,0,0,01:45:24/994-15:07:32,11) [events/0]
(root,0,0,01:49:26/994-15:07:32,12) [events/1]
(root,0,0,00:00:00/994-15:07:32,13) [cgroup]
(root,0,0,00:00:00/994-15:07:32,14) [khelper]
(root,0,0,00:00:00/994-15:07:32,15) [netns]
(root,0,0,00:00:00/994-15:07:32,16) [async/mgr]
(root,0,0,00:00:00/994-15:07:32,17) [pm]
(root,0,0,00:00:00/994-15:07:32,18) [xenwatch]
(root,0,0,00:00:00/994-15:07:32,19) [xenbus]
(root,0,0,00:05:36/994-15:07:32,20) [sync_supers]
(root,0,0,00:06:43/994-15:07:32,21) [bdi-default]
(root,0,0,00:00:00/994-15:07:32,22) [kintegrityd/0]
(root,0,0,00:00:00/994-15:07:32,23) [kintegrityd/1]
(root,0,0,00:05:26/994-15:07:32,24) [kblockd/0]
(root,0,0,00:01:06/994-15:07:32,25) [kblockd/1]
(root,0,0,00:00:00/994-15:07:32,26) [ata_aux]
(root,0,0,00:00:00/994-15:07:32,27) [ata_sff/0]
(root,0,0,00:00:00/994-15:07:32,28) [ata_sff/1]
(root,0,0,00:00:00/994-15:07:32,29) [ksuspend_usbd]
(root,0,0,00:00:00/994-15:07:32,30) [khubd]
(root,0,0,00:00:00/994-15:07:32,31) [kseriod]
(root,0,0,00:00:00/994-15:07:32,32) [md/0]
(root,0,0,00:00:00/994-15:07:32,33) [md/1]
(root,0,0,00:00:00/994-15:07:32,34) [md_misc/0]
(root,0,0,00:00:00/994-15:07:32,35) [md_misc/1]
(root,0,0,00:00:00/994-15:07:32,36) [linkwatch]
(root,0,0,00:00:31/994-15:07:32,37) [khungtaskd]
(root,0,0,00:00:01/994-15:07:32,38) [kswapd0]
(root,0,0,00:00:00/994-15:07:32,39) [ksmd]
(root,0,0,00:00:00/994-15:07:32,40) [aio/0]
(root,0,0,00:00:00/994-15:07:32,41) [aio/1]
(root,0,0,00:00:00/994-15:07:32,42) [crypto/0]
(root,0,0,00:00:00/994-15:07:32,43) [crypto/1]
(root,0,0,00:00:00/994-15:07:32,51) [kthrotld/0]
(root,0,0,00:00:00/994-15:07:32,52) [kthrotld/1]
(root,0,0,00:00:00/994-15:07:32,54) [khvcd]
(root,0,0,00:00:00/994-15:07:32,55) [kpsmoused]
(root,0,0,00:00:00/994-15:07:32,56) [usbhid_resumer]
(root,0,0,00:00:00/994-15:07:32,57) [deferwq]
(root,0,0,00:00:00/994-15:07:32,89) [kdmremove]
(root,0,0,00:00:00/994-15:07:32,90) [kstriped]
(root,0,0,00:00:00/994-15:07:27,233) [kdmflush]
(root,0,0,00:00:00/994-15:07:27,235) [kdmflush]
(root,0,0,00:00:17/994-15:07:14,252) [kjournald]
(root,10936,436,00:00:00/994-15:06:54,341) /sbin/udevd -d
(root,0,0,00:00:00/994-15:06:39,610) [kdmflush]
(root,0,0,00:00:00/994-15:06:39,613) [kdmflush]
(root,0,0,00:00:00/994-15:06:39,616) [kdmflush]
(root,0,0,00:00:00/994-15:06:39,621) [kdmflush]
(root,0,0,00:00:00/994-15:06:39,627) [kdmflush]
(root,10932,556,00:00:00/994-15:06:39,628) /sbin/udevd -d
(root,0,0,00:00:00/994-15:06:39,631) [kdmflush]
(root,10932,520,00:00:00/994-15:06:39,632) /sbin/udevd -d
(root,0,0,00:10:46/994-15:06:27,702) [flush-253:4]
(root,0,0,00:00:00/994-15:06:18,706) [kjournald]
(root,0,0,00:00:00/994-15:06:17,709) [xfs_mru_cache]
(root,0,0,00:05:57/994-15:06:17,710) [xfslogd/0]
(root,0,0,00:00:00/994-15:06:17,711) [xfslogd/1]
(root,0,0,00:07:40/994-15:06:17,712) [xfsdatad/0]
(root,0,0,00:00:00/994-15:06:17,713) [xfsdatad/1]
(root,0,0,00:00:00/994-15:06:17,714) [xfsconvertd/0]
(root,0,0,00:00:00/994-15:06:17,715) [xfsconvertd/1]
(root,0,0,00:00:08/994-15:06:17,716) [xfsalloc/0]
(root,0,0,00:00:22/994-15:06:17,717) [xfsalloc/1]
(root,0,0,00:00:08/994-15:06:17,718) [xfseofblocks/0]
(root,0,0,00:00:31/994-15:06:17,719) [xfseofblocks/1]
(root,0,0,00:00:00/994-15:06:17,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/994-15:06:17,721) [xfs-cil/dm-3]
(root,0,0,00:01:09/994-15:06:17,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/994-15:06:16,723) [xfsaild/dm-3]
(root,0,0,00:00:00/994-15:06:14,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/994-15:06:14,725) [xfs-cil/dm-2]
(root,0,0,00:01:09/994-15:06:14,726) [xfssyncd/dm-2]
(root,0,0,05:06:55/994-15:06:13,727) [xfsaild/dm-2]
(root,0,0,00:10:58/994-15:05:46,728) [kjournald]
(root,0,0,00:05:02/994-15:05:45,729) [xfsbufd/dm-5]
(root,0,0,00:03:13/994-15:05:45,730) [xfs-cil/dm-5]
(root,0,0,00:04:40/994-15:05:45,731) [xfssyncd/dm-5]
(root,0,0,07:02:00/994-15:05:45,732) [xfsaild/dm-5]
(root,0,0,00:00:02/994-15:05:43,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/994-15:05:43,734) [xfs-cil/dm-7]
(root,0,0,00:01:09/994-15:05:43,735) [xfssyncd/dm-7]
(root,0,0,05:08:46/994-15:05:43,736) [xfsaild/dm-7]
(root,0,0,00:00:00/994-15:05:41,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/994-15:05:41,738) [xfs-cil/dm-6]
(root,0,0,00:01:11/994-15:05:41,739) [xfssyncd/dm-6]
(root,0,0,05:09:15/994-15:05:41,740) [xfsaild/dm-6]
(root,0,0,00:31:35/994-15:05:22,816) [kauditd]
(root,93156,756,02:10:03/994-15:05:08,1154) auditd
(root,249864,5716,01:16:38/994-15:05:07,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:27/994-15:05:06,1195) rpcbind
(rpcuser,23404,1156,00:00:00/994-15:05:05,1215) rpc.statd
(dbus,21580,1040,00:00:04/994-15:05:03,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/994-15:05:01,1285) hald
(root,20400,956,00:00:00/994-15:05:01,1286) hald-runner
(root,452700,1544,00:23:43/994-15:04:55,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:42:48/994-15:04:50,1375) /usr/sbin/sshd
(root,21716,848,00:16:15/994-15:04:49,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:19:59/994-15:04:45,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:54/994-15:04:37,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:04/994-15:04:36,1555) qmgr -l -t fifo -u
(rabbitmq,10832,584,00:16:02/994-15:04:26,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/994-15:04:24,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/994-15:04:24,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/994-15:04:24,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1423500,332188,6-04:36:33/994-15:04:24,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:43/994-15:04:04,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:07/994-15:04:04,1759) inet_gethost 4
(root,112532,964,00:00:00/994-15:04:03,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,532076,140084,00:56:29/994-15:03:58,1776) /usr/sbin/httpd
(root,116864,1220,00:08:38/994-15:03:57,1786) crond
(root,21104,484,00:00:01/994-15:03:57,1799) /usr/sbin/atd
(root,4064,544,00:00:00/994-15:03:57,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/994-15:03:57,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/994-15:03:57,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/994-15:03:57,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/994-15:03:57,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/994-15:03:57,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/994-15:03:57,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:00/01:25:04,5593) [flush-253:5]
(postfix,80944,3364,00:00:00/33:42,12225) pickup -l -t fifo -u
(root,110268,1488,00:00:00/00:01,16603) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:01,16621) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,16622) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/191-23:16:42,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/191-23:16:42,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/191-23:16:42,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521336,17472,16:22:24/191-23:16:42,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(apache,533808,133648,00:00:00/11:38:00,26949) /usr/sbin/httpd
(apache,533808,133636,00:00:00/11:37:59,26950) /usr/sbin/httpd
(apache,533808,133628,00:00:00/11:37:59,26951) /usr/sbin/httpd
(apache,532076,129456,00:00:00/1-05:31:13,29912) /usr/sbin/httpd
(apache,533808,133724,00:00:00/1-05:31:12,29921) /usr/sbin/httpd
(apache,533808,133688,00:00:00/1-05:31:12,29926) /usr/sbin/httpd
(apache,533808,133740,00:00:00/1-05:31:12,29933) /usr/sbin/httpd
(apache,533808,133780,00:00:00/1-05:31:12,29938) /usr/sbin/httpd
(apache,533808,133760,00:00:00/1-05:31:12,29946) /usr/sbin/httpd
(apache,533808,133724,00:00:00/1-05:31:12,29951) /usr/sbin/httpd
(apache,533808,133720,00:00:00/1-05:31:12,29956) /usr/sbin/httpd
(apache,533808,133720,00:00:00/1-05:31:12,29963) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-02-27 13:44

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939f60ab655

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:13:38/988-01:28:51,1) /sbin/init
(root,0,0,00:00:03/988-01:28:51,2) [kthreadd]
(root,0,0,00:09:05/988-01:28:51,3) [migration/0]
(root,0,0,00:06:22/988-01:28:51,4) [ksoftirqd/0]
(root,0,0,00:00:00/988-01:28:51,5) [stopper/0]
(root,0,0,00:02:33/988-01:28:51,6) [watchdog/0]
(root,0,0,00:12:07/988-01:28:51,7) [migration/1]
(root,0,0,00:00:00/988-01:28:51,8) [stopper/1]
(root,0,0,00:03:42/988-01:28:51,9) [ksoftirqd/1]
(root,0,0,00:02:24/988-01:28:51,10) [watchdog/1]
(root,0,0,01:44:41/988-01:28:51,11) [events/0]
(root,0,0,01:48:41/988-01:28:51,12) [events/1]
(root,0,0,00:00:00/988-01:28:51,13) [cgroup]
(root,0,0,00:00:00/988-01:28:51,14) [khelper]
(root,0,0,00:00:00/988-01:28:51,15) [netns]
(root,0,0,00:00:00/988-01:28:51,16) [async/mgr]
(root,0,0,00:00:00/988-01:28:51,17) [pm]
(root,0,0,00:00:00/988-01:28:51,18) [xenwatch]
(root,0,0,00:00:00/988-01:28:51,19) [xenbus]
(root,0,0,00:05:34/988-01:28:51,20) [sync_supers]
(root,0,0,00:06:40/988-01:28:51,21) [bdi-default]
(root,0,0,00:00:00/988-01:28:51,22) [kintegrityd/0]
(root,0,0,00:00:00/988-01:28:51,23) [kintegrityd/1]
(root,0,0,00:05:24/988-01:28:51,24) [kblockd/0]
(root,0,0,00:01:06/988-01:28:51,25) [kblockd/1]
(root,0,0,00:00:00/988-01:28:51,26) [ata_aux]
(root,0,0,00:00:00/988-01:28:51,27) [ata_sff/0]
(root,0,0,00:00:00/988-01:28:51,28) [ata_sff/1]
(root,0,0,00:00:00/988-01:28:51,29) [ksuspend_usbd]
(root,0,0,00:00:00/988-01:28:51,30) [khubd]
(root,0,0,00:00:00/988-01:28:51,31) [kseriod]
(root,0,0,00:00:00/988-01:28:51,32) [md/0]
(root,0,0,00:00:00/988-01:28:51,33) [md/1]
(root,0,0,00:00:00/988-01:28:51,34) [md_misc/0]
(root,0,0,00:00:00/988-01:28:51,35) [md_misc/1]
(root,0,0,00:00:00/988-01:28:51,36) [linkwatch]
(root,0,0,00:00:31/988-01:28:51,37) [khungtaskd]
(root,0,0,00:00:01/988-01:28:51,38) [kswapd0]
(root,0,0,00:00:00/988-01:28:51,39) [ksmd]
(root,0,0,00:00:00/988-01:28:51,40) [aio/0]
(root,0,0,00:00:00/988-01:28:51,41) [aio/1]
(root,0,0,00:00:00/988-01:28:51,42) [crypto/0]
(root,0,0,00:00:00/988-01:28:51,43) [crypto/1]
(root,0,0,00:00:00/988-01:28:51,51) [kthrotld/0]
(root,0,0,00:00:00/988-01:28:51,52) [kthrotld/1]
(root,0,0,00:00:00/988-01:28:51,54) [khvcd]
(root,0,0,00:00:00/988-01:28:51,55) [kpsmoused]
(root,0,0,00:00:00/988-01:28:51,56) [usbhid_resumer]
(root,0,0,00:00:00/988-01:28:51,57) [deferwq]
(root,0,0,00:00:00/988-01:28:51,89) [kdmremove]
(root,0,0,00:00:00/988-01:28:51,90) [kstriped]
(root,0,0,00:00:00/988-01:28:46,233) [kdmflush]
(root,0,0,00:00:00/988-01:28:46,235) [kdmflush]
(root,0,0,00:00:16/988-01:28:33,252) [kjournald]
(root,10936,436,00:00:00/988-01:28:13,341) /sbin/udevd -d
(root,0,0,00:00:00/988-01:27:58,610) [kdmflush]
(root,0,0,00:00:00/988-01:27:58,613) [kdmflush]
(root,0,0,00:00:00/988-01:27:58,616) [kdmflush]
(root,0,0,00:00:00/988-01:27:58,621) [kdmflush]
(root,0,0,00:00:00/988-01:27:58,627) [kdmflush]
(root,10932,556,00:00:00/988-01:27:58,628) /sbin/udevd -d
(root,0,0,00:00:00/988-01:27:58,631) [kdmflush]
(root,10932,520,00:00:00/988-01:27:58,632) /sbin/udevd -d
(root,0,0,00:10:41/988-01:27:46,702) [flush-253:4]
(root,0,0,00:00:00/988-01:27:37,706) [kjournald]
(root,0,0,00:00:00/988-01:27:36,709) [xfs_mru_cache]
(root,0,0,00:05:55/988-01:27:36,710) [xfslogd/0]
(root,0,0,00:00:00/988-01:27:36,711) [xfslogd/1]
(root,0,0,00:07:38/988-01:27:36,712) [xfsdatad/0]
(root,0,0,00:00:00/988-01:27:36,713) [xfsdatad/1]
(root,0,0,00:00:00/988-01:27:36,714) [xfsconvertd/0]
(root,0,0,00:00:00/988-01:27:36,715) [xfsconvertd/1]
(root,0,0,00:00:08/988-01:27:36,716) [xfsalloc/0]
(root,0,0,00:00:22/988-01:27:36,717) [xfsalloc/1]
(root,0,0,00:00:08/988-01:27:36,718) [xfseofblocks/0]
(root,0,0,00:00:31/988-01:27:36,719) [xfseofblocks/1]
(root,0,0,00:00:00/988-01:27:36,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/988-01:27:36,721) [xfs-cil/dm-3]
(root,0,0,00:01:08/988-01:27:36,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/988-01:27:35,723) [xfsaild/dm-3]
(root,0,0,00:00:00/988-01:27:33,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/988-01:27:33,725) [xfs-cil/dm-2]
(root,0,0,00:01:09/988-01:27:33,726) [xfssyncd/dm-2]
(root,0,0,05:04:43/988-01:27:32,727) [xfsaild/dm-2]
(root,0,0,00:10:54/988-01:27:05,728) [kjournald]
(root,0,0,00:05:00/988-01:27:04,729) [xfsbufd/dm-5]
(root,0,0,00:03:12/988-01:27:04,730) [xfs-cil/dm-5]
(root,0,0,00:04:39/988-01:27:04,731) [xfssyncd/dm-5]
(root,0,0,06:59:10/988-01:27:04,732) [xfsaild/dm-5]
(root,0,0,00:00:02/988-01:27:02,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/988-01:27:02,734) [xfs-cil/dm-7]
(root,0,0,00:01:08/988-01:27:02,735) [xfssyncd/dm-7]
(root,0,0,05:06:32/988-01:27:02,736) [xfsaild/dm-7]
(root,0,0,00:00:00/988-01:27:00,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/988-01:27:00,738) [xfs-cil/dm-6]
(root,0,0,00:01:11/988-01:27:00,739) [xfssyncd/dm-6]
(root,0,0,05:07:00/988-01:27:00,740) [xfsaild/dm-6]
(root,0,0,00:31:25/988-01:26:41,816) [kauditd]
(root,93156,756,02:09:21/988-01:26:27,1154) auditd
(root,249864,5716,01:16:13/988-01:26:26,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:26/988-01:26:25,1195) rpcbind
(rpcuser,23404,1156,00:00:00/988-01:26:24,1215) rpc.statd
(dbus,21580,1040,00:00:04/988-01:26:22,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/988-01:26:20,1285) hald
(root,20400,956,00:00:00/988-01:26:20,1286) hald-runner
(root,452700,1544,00:23:34/988-01:26:14,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:41:59/988-01:26:09,1375) /usr/sbin/sshd
(root,21716,848,00:16:08/988-01:26:08,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:19:51/988-01:26:04,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:51/988-01:25:56,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:04/988-01:25:55,1555) qmgr -l -t fifo -u
(rabbitmq,10832,584,00:15:56/988-01:25:45,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/988-01:25:43,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/988-01:25:43,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/988-01:25:43,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424660,332148,6-03:37:57/988-01:25:43,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:43/988-01:25:23,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:06/988-01:25:23,1759) inet_gethost 4
(root,112532,964,00:00:00/988-01:25:22,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,531284,139240,00:56:04/988-01:25:17,1776) /usr/sbin/httpd
(root,116864,1220,00:08:34/988-01:25:16,1786) crond
(root,21104,484,00:00:01/988-01:25:16,1799) /usr/sbin/atd
(root,4064,544,00:00:00/988-01:25:16,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/988-01:25:16,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/988-01:25:16,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/988-01:25:16,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/988-01:25:16,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/988-01:25:16,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/988-01:25:16,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,108468,1060,00:00:00/185-09:38:01,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/185-09:38:01,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/185-09:38:01,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1521336,17652,15:48:15/185-09:38:01,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3360,00:00:00/01:22:57,21581) pickup -l -t fifo -u
(root,0,0,00:00:00/05:05:50,26564) [flush-253:5]
(apache,532968,132828,00:00:00/22:19:33,27244) /usr/sbin/httpd
(apache,532968,132864,00:00:00/22:19:32,27245) /usr/sbin/httpd
(apache,532968,132868,00:00:00/22:19:32,27246) /usr/sbin/httpd
(apache,531284,128612,00:00:00/1-15:36:31,28426) /usr/sbin/httpd
(apache,532976,132900,00:00:00/1-15:36:31,28435) /usr/sbin/httpd
(apache,532968,132928,00:00:00/1-15:36:31,28438) /usr/sbin/httpd
(apache,532976,132896,00:00:00/1-15:36:31,28445) /usr/sbin/httpd
(apache,532968,132900,00:00:00/1-15:36:31,28450) /usr/sbin/httpd
(apache,532976,132892,00:00:00/1-15:36:30,28457) /usr/sbin/httpd
(apache,532968,132940,00:00:00/1-15:36:30,28465) /usr/sbin/httpd
(apache,532968,132868,00:00:00/1-15:36:30,28470) /usr/sbin/httpd
(apache,532968,132964,00:00:00/1-15:36:30,28477) /usr/sbin/httpd
(root,110268,1488,00:00:00/00:00,31923) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:00,31941) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:00,31942) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-02-21 00:05

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793904a1f7e1

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:13:28/976-15:31:53,1) /sbin/init
(root,0,0,00:00:03/976-15:31:53,2) [kthreadd]
(root,0,0,00:08:59/976-15:31:53,3) [migration/0]
(root,0,0,00:06:14/976-15:31:53,4) [ksoftirqd/0]
(root,0,0,00:00:00/976-15:31:53,5) [stopper/0]
(root,0,0,00:02:31/976-15:31:53,6) [watchdog/0]
(root,0,0,00:11:58/976-15:31:53,7) [migration/1]
(root,0,0,00:00:00/976-15:31:53,8) [stopper/1]
(root,0,0,00:03:38/976-15:31:53,9) [ksoftirqd/1]
(root,0,0,00:02:22/976-15:31:53,10) [watchdog/1]
(root,0,0,01:43:26/976-15:31:53,11) [events/0]
(root,0,0,01:47:22/976-15:31:53,12) [events/1]
(root,0,0,00:00:00/976-15:31:53,13) [cgroup]
(root,0,0,00:00:00/976-15:31:53,14) [khelper]
(root,0,0,00:00:00/976-15:31:53,15) [netns]
(root,0,0,00:00:00/976-15:31:53,16) [async/mgr]
(root,0,0,00:00:00/976-15:31:53,17) [pm]
(root,0,0,00:00:00/976-15:31:53,18) [xenwatch]
(root,0,0,00:00:00/976-15:31:53,19) [xenbus]
(root,0,0,00:05:30/976-15:31:53,20) [sync_supers]
(root,0,0,00:06:36/976-15:31:53,21) [bdi-default]
(root,0,0,00:00:00/976-15:31:53,22) [kintegrityd/0]
(root,0,0,00:00:00/976-15:31:53,23) [kintegrityd/1]
(root,0,0,00:05:21/976-15:31:53,24) [kblockd/0]
(root,0,0,00:01:05/976-15:31:53,25) [kblockd/1]
(root,0,0,00:00:00/976-15:31:53,26) [ata_aux]
(root,0,0,00:00:00/976-15:31:53,27) [ata_sff/0]
(root,0,0,00:00:00/976-15:31:53,28) [ata_sff/1]
(root,0,0,00:00:00/976-15:31:53,29) [ksuspend_usbd]
(root,0,0,00:00:00/976-15:31:53,30) [khubd]
(root,0,0,00:00:00/976-15:31:53,31) [kseriod]
(root,0,0,00:00:00/976-15:31:53,32) [md/0]
(root,0,0,00:00:00/976-15:31:53,33) [md/1]
(root,0,0,00:00:00/976-15:31:53,34) [md_misc/0]
(root,0,0,00:00:00/976-15:31:53,35) [md_misc/1]
(root,0,0,00:00:00/976-15:31:53,36) [linkwatch]
(root,0,0,00:00:31/976-15:31:53,37) [khungtaskd]
(root,0,0,00:00:00/976-15:31:53,38) [kswapd0]
(root,0,0,00:00:00/976-15:31:53,39) [ksmd]
(root,0,0,00:00:00/976-15:31:53,40) [aio/0]
(root,0,0,00:00:00/976-15:31:53,41) [aio/1]
(root,0,0,00:00:00/976-15:31:53,42) [crypto/0]
(root,0,0,00:00:00/976-15:31:53,43) [crypto/1]
(root,0,0,00:00:00/976-15:31:53,51) [kthrotld/0]
(root,0,0,00:00:00/976-15:31:53,52) [kthrotld/1]
(root,0,0,00:00:00/976-15:31:53,54) [khvcd]
(root,0,0,00:00:00/976-15:31:53,55) [kpsmoused]
(root,0,0,00:00:00/976-15:31:53,56) [usbhid_resumer]
(root,0,0,00:00:00/976-15:31:53,57) [deferwq]
(root,0,0,00:00:00/976-15:31:53,89) [kdmremove]
(root,0,0,00:00:00/976-15:31:53,90) [kstriped]
(root,0,0,00:00:00/976-15:31:48,233) [kdmflush]
(root,0,0,00:00:00/976-15:31:48,235) [kdmflush]
(root,0,0,00:00:16/976-15:31:35,252) [kjournald]
(root,10936,436,00:00:00/976-15:31:15,341) /sbin/udevd -d
(root,0,0,00:00:00/976-15:31:00,610) [kdmflush]
(root,0,0,00:00:00/976-15:31:00,613) [kdmflush]
(root,0,0,00:00:00/976-15:31:00,616) [kdmflush]
(root,0,0,00:00:00/976-15:31:00,621) [kdmflush]
(root,0,0,00:00:00/976-15:31:00,627) [kdmflush]
(root,10932,556,00:00:00/976-15:31:00,628) /sbin/udevd -d
(root,0,0,00:00:00/976-15:31:00,631) [kdmflush]
(root,10932,520,00:00:00/976-15:31:00,632) /sbin/udevd -d
(root,0,0,00:10:33/976-15:30:48,702) [flush-253:4]
(root,0,0,00:00:00/976-15:30:39,706) [kjournald]
(root,0,0,00:00:00/976-15:30:38,709) [xfs_mru_cache]
(root,0,0,00:05:51/976-15:30:38,710) [xfslogd/0]
(root,0,0,00:00:00/976-15:30:38,711) [xfslogd/1]
(root,0,0,00:07:33/976-15:30:38,712) [xfsdatad/0]
(root,0,0,00:00:00/976-15:30:38,713) [xfsdatad/1]
(root,0,0,00:00:00/976-15:30:38,714) [xfsconvertd/0]
(root,0,0,00:00:00/976-15:30:38,715) [xfsconvertd/1]
(root,0,0,00:00:08/976-15:30:38,716) [xfsalloc/0]
(root,0,0,00:00:22/976-15:30:38,717) [xfsalloc/1]
(root,0,0,00:00:08/976-15:30:38,718) [xfseofblocks/0]
(root,0,0,00:00:31/976-15:30:38,719) [xfseofblocks/1]
(root,0,0,00:00:00/976-15:30:38,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/976-15:30:38,721) [xfs-cil/dm-3]
(root,0,0,00:01:07/976-15:30:38,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/976-15:30:37,723) [xfsaild/dm-3]
(root,0,0,00:00:00/976-15:30:35,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/976-15:30:35,725) [xfs-cil/dm-2]
(root,0,0,00:01:08/976-15:30:35,726) [xfssyncd/dm-2]
(root,0,0,05:00:51/976-15:30:34,727) [xfsaild/dm-2]
(root,0,0,00:10:46/976-15:30:07,728) [kjournald]
(root,0,0,00:04:57/976-15:30:06,729) [xfsbufd/dm-5]
(root,0,0,00:03:09/976-15:30:06,730) [xfs-cil/dm-5]
(root,0,0,00:04:35/976-15:30:06,731) [xfssyncd/dm-5]
(root,0,0,06:54:13/976-15:30:06,732) [xfsaild/dm-5]
(root,0,0,00:00:02/976-15:30:04,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/976-15:30:04,734) [xfs-cil/dm-7]
(root,0,0,00:01:07/976-15:30:04,735) [xfssyncd/dm-7]
(root,0,0,05:02:38/976-15:30:04,736) [xfsaild/dm-7]
(root,0,0,00:00:00/976-15:30:02,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/976-15:30:02,738) [xfs-cil/dm-6]
(root,0,0,00:01:10/976-15:30:02,739) [xfssyncd/dm-6]
(root,0,0,05:03:04/976-15:30:02,740) [xfsaild/dm-6]
(root,0,0,00:31:04/976-15:29:43,816) [kauditd]
(root,93156,756,02:07:53/976-15:29:29,1154) auditd
(root,249864,5716,01:15:23/976-15:29:28,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:25/976-15:29:27,1195) rpcbind
(rpcuser,23404,1156,00:00:00/976-15:29:26,1215) rpc.statd
(dbus,21580,1040,00:00:04/976-15:29:24,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/976-15:29:22,1285) hald
(root,20400,956,00:00:00/976-15:29:22,1286) hald-runner
(root,452700,1544,00:23:17/976-15:29:16,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:40:16/976-15:29:11,1375) /usr/sbin/sshd
(root,21716,848,00:15:57/976-15:29:10,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:19:37/976-15:29:06,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:47/976-15:28:58,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:03/976-15:28:57,1555) qmgr -l -t fifo -u
(rabbitmq,10832,584,00:15:44/976-15:28:47,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/976-15:28:45,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/976-15:28:45,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/976-15:28:45,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1425396,332824,6-01:56:30/976-15:28:45,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:41/976-15:28:25,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:04/976-15:28:25,1759) inet_gethost 4
(root,112532,964,00:00:00/976-15:28:24,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,529568,137548,00:55:20/976-15:28:19,1776) /usr/sbin/httpd
(root,116864,1220,00:08:28/976-15:28:18,1786) crond
(root,21104,484,00:00:01/976-15:28:18,1799) /usr/sbin/atd
(root,4064,544,00:00:00/976-15:28:18,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/976-15:28:18,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/976-15:28:18,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/976-15:28:18,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/976-15:28:18,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/976-15:28:18,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/976-15:28:18,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3364,00:00:00/01:00:22,1974) pickup -l -t fifo -u
(apache,531284,131656,00:00:00/3-20:03:57,7058) /usr/sbin/httpd
(root,0,0,00:00:00/02:05,8979) [flush-253:1]
(root,101428,4388,00:00:00/00:14,9214) sshd: root [priv]
(sshd,67568,1636,00:00:00/00:14,9215) sshd: root [net] 
(root,67568,3264,00:00:00/00:02,9220) sshd: [accepted] 
(sshd,67568,1572,00:00:00/00:02,9221) sshd: [net]      
(root,110268,1492,00:00:00/00:01,9330) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,9348) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,9349) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,108468,1060,00:00:00/173-23:41:03,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/173-23:41:03,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/173-23:41:03,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17264,14:48:50/173-23:41:03,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/02:38:51,22437) [flush-253:5]
(apache,529568,126920,00:00:00/4-05:48:29,26007) /usr/sbin/httpd
(apache,531284,131656,00:00:00/4-05:48:29,26008) /usr/sbin/httpd
(apache,531276,131360,00:00:00/4-05:48:29,26009) /usr/sbin/httpd
(apache,531284,131408,00:00:00/4-05:48:28,26011) /usr/sbin/httpd
(apache,531284,131368,00:00:00/4-05:48:28,26012) /usr/sbin/httpd
(apache,531284,131656,00:00:00/4-05:48:28,26018) /usr/sbin/httpd
(apache,531284,131648,00:00:00/4-05:48:28,26023) /usr/sbin/httpd
(apache,531284,131676,00:00:00/4-05:48:28,26025) /usr/sbin/httpd
(apache,531284,131664,00:00:00/4-05:48:28,26028) /usr/sbin/httpd
(apache,531276,131256,00:00:00/1-08:57:07,29572) /usr/sbin/httpd
(apache,531276,131600,00:00:00/1-08:57:06,29574) /usr/sbin/httpd
(apache,531276,131328,00:00:00/1-08:57:06,29575) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-02-09 14:08

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939174668ac

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:13:13/967-17:49:56,1) /sbin/init
(root,0,0,00:00:03/967-17:49:56,2) [kthreadd]
(root,0,0,00:08:54/967-17:49:56,3) [migration/0]
(root,0,0,00:06:09/967-17:49:56,4) [ksoftirqd/0]
(root,0,0,00:00:00/967-17:49:56,5) [stopper/0]
(root,0,0,00:02:30/967-17:49:56,6) [watchdog/0]
(root,0,0,00:11:50/967-17:49:56,7) [migration/1]
(root,0,0,00:00:00/967-17:49:56,8) [stopper/1]
(root,0,0,00:03:35/967-17:49:56,9) [ksoftirqd/1]
(root,0,0,00:02:21/967-17:49:56,10) [watchdog/1]
(root,0,0,01:42:29/967-17:49:56,11) [events/0]
(root,0,0,01:46:21/967-17:49:56,12) [events/1]
(root,0,0,00:00:00/967-17:49:56,13) [cgroup]
(root,0,0,00:00:00/967-17:49:56,14) [khelper]
(root,0,0,00:00:00/967-17:49:56,15) [netns]
(root,0,0,00:00:00/967-17:49:56,16) [async/mgr]
(root,0,0,00:00:00/967-17:49:56,17) [pm]
(root,0,0,00:00:00/967-17:49:56,18) [xenwatch]
(root,0,0,00:00:00/967-17:49:56,19) [xenbus]
(root,0,0,00:05:27/967-17:49:56,20) [sync_supers]
(root,0,0,00:06:32/967-17:49:56,21) [bdi-default]
(root,0,0,00:00:00/967-17:49:56,22) [kintegrityd/0]
(root,0,0,00:00:00/967-17:49:56,23) [kintegrityd/1]
(root,0,0,00:05:17/967-17:49:56,24) [kblockd/0]
(root,0,0,00:01:04/967-17:49:56,25) [kblockd/1]
(root,0,0,00:00:00/967-17:49:56,26) [ata_aux]
(root,0,0,00:00:00/967-17:49:56,27) [ata_sff/0]
(root,0,0,00:00:00/967-17:49:56,28) [ata_sff/1]
(root,0,0,00:00:00/967-17:49:56,29) [ksuspend_usbd]
(root,0,0,00:00:00/967-17:49:56,30) [khubd]
(root,0,0,00:00:00/967-17:49:56,31) [kseriod]
(root,0,0,00:00:00/967-17:49:56,32) [md/0]
(root,0,0,00:00:00/967-17:49:56,33) [md/1]
(root,0,0,00:00:00/967-17:49:56,34) [md_misc/0]
(root,0,0,00:00:00/967-17:49:56,35) [md_misc/1]
(root,0,0,00:00:00/967-17:49:56,36) [linkwatch]
(root,0,0,00:00:31/967-17:49:56,37) [khungtaskd]
(root,0,0,00:00:00/967-17:49:56,38) [kswapd0]
(root,0,0,00:00:00/967-17:49:56,39) [ksmd]
(root,0,0,00:00:00/967-17:49:56,40) [aio/0]
(root,0,0,00:00:00/967-17:49:56,41) [aio/1]
(root,0,0,00:00:00/967-17:49:56,42) [crypto/0]
(root,0,0,00:00:00/967-17:49:56,43) [crypto/1]
(root,0,0,00:00:00/967-17:49:56,51) [kthrotld/0]
(root,0,0,00:00:00/967-17:49:56,52) [kthrotld/1]
(root,0,0,00:00:00/967-17:49:56,54) [khvcd]
(root,0,0,00:00:00/967-17:49:56,55) [kpsmoused]
(root,0,0,00:00:00/967-17:49:56,56) [usbhid_resumer]
(root,0,0,00:00:00/967-17:49:56,57) [deferwq]
(root,0,0,00:00:00/967-17:49:56,89) [kdmremove]
(root,0,0,00:00:00/967-17:49:56,90) [kstriped]
(root,0,0,00:00:00/967-17:49:51,233) [kdmflush]
(root,0,0,00:00:00/967-17:49:51,235) [kdmflush]
(root,0,0,00:00:16/967-17:49:38,252) [kjournald]
(root,10936,436,00:00:00/967-17:49:18,341) /sbin/udevd -d
(root,0,0,00:00:00/967-17:49:03,610) [kdmflush]
(root,0,0,00:00:00/967-17:49:03,613) [kdmflush]
(root,0,0,00:00:00/967-17:49:03,616) [kdmflush]
(root,0,0,00:00:00/967-17:49:03,621) [kdmflush]
(root,0,0,00:00:00/967-17:49:03,627) [kdmflush]
(root,10932,556,00:00:00/967-17:49:03,628) /sbin/udevd -d
(root,0,0,00:00:00/967-17:49:03,631) [kdmflush]
(root,10932,520,00:00:00/967-17:49:03,632) /sbin/udevd -d
(root,0,0,00:10:27/967-17:48:51,702) [flush-253:4]
(root,0,0,00:00:00/967-17:48:42,706) [kjournald]
(root,0,0,00:00:00/967-17:48:41,709) [xfs_mru_cache]
(root,0,0,00:05:46/967-17:48:41,710) [xfslogd/0]
(root,0,0,00:00:00/967-17:48:41,711) [xfslogd/1]
(root,0,0,00:07:27/967-17:48:41,712) [xfsdatad/0]
(root,0,0,00:00:00/967-17:48:41,713) [xfsdatad/1]
(root,0,0,00:00:00/967-17:48:41,714) [xfsconvertd/0]
(root,0,0,00:00:00/967-17:48:41,715) [xfsconvertd/1]
(root,0,0,00:00:08/967-17:48:41,716) [xfsalloc/0]
(root,0,0,00:00:22/967-17:48:41,717) [xfsalloc/1]
(root,0,0,00:00:08/967-17:48:41,718) [xfseofblocks/0]
(root,0,0,00:00:30/967-17:48:41,719) [xfseofblocks/1]
(root,0,0,00:00:00/967-17:48:41,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/967-17:48:41,721) [xfs-cil/dm-3]
(root,0,0,00:01:07/967-17:48:41,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/967-17:48:40,723) [xfsaild/dm-3]
(root,0,0,00:00:00/967-17:48:38,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/967-17:48:38,725) [xfs-cil/dm-2]
(root,0,0,00:01:07/967-17:48:38,726) [xfssyncd/dm-2]
(root,0,0,04:57:52/967-17:48:37,727) [xfsaild/dm-2]
(root,0,0,00:10:40/967-17:48:10,728) [kjournald]
(root,0,0,00:04:54/967-17:48:09,729) [xfsbufd/dm-5]
(root,0,0,00:03:07/967-17:48:09,730) [xfs-cil/dm-5]
(root,0,0,00:04:33/967-17:48:09,731) [xfssyncd/dm-5]
(root,0,0,06:50:21/967-17:48:09,732) [xfsaild/dm-5]
(root,0,0,00:00:02/967-17:48:07,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/967-17:48:07,734) [xfs-cil/dm-7]
(root,0,0,00:01:07/967-17:48:07,735) [xfssyncd/dm-7]
(root,0,0,04:59:33/967-17:48:07,736) [xfsaild/dm-7]
(root,0,0,00:00:00/967-17:48:05,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/967-17:48:05,738) [xfs-cil/dm-6]
(root,0,0,00:01:09/967-17:48:05,739) [xfssyncd/dm-6]
(root,0,0,05:00:01/967-17:48:05,740) [xfsaild/dm-6]
(root,0,0,00:30:35/967-17:47:46,816) [kauditd]
(root,93156,756,02:05:48/967-17:47:32,1154) auditd
(root,249864,5716,01:14:17/967-17:47:31,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:23/967-17:47:30,1195) rpcbind
(rpcuser,23404,1156,00:00:00/967-17:47:29,1215) rpc.statd
(dbus,21580,1040,00:00:04/967-17:47:27,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/967-17:47:25,1285) hald
(root,20400,956,00:00:00/967-17:47:25,1286) hald-runner
(root,452700,1544,00:23:04/967-17:47:19,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:37:39/967-17:47:14,1375) /usr/sbin/sshd
(root,21716,848,00:15:49/967-17:47:13,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:19:26/967-17:47:09,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:43/967-17:47:01,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:02/967-17:47:00,1555) qmgr -l -t fifo -u
(rabbitmq,10832,584,00:15:36/967-17:46:50,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/967-17:46:48,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/967-17:46:48,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/967-17:46:48,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424012,332308,6-00:36:47/967-17:46:48,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:40/967-17:46:28,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:02/967-17:46:28,1759) inet_gethost 4
(root,112532,964,00:00:00/967-17:46:27,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,528636,136704,00:54:46/967-17:46:22,1776) /usr/sbin/httpd
(root,116864,1220,00:08:24/967-17:46:21,1786) crond
(root,21104,484,00:00:01/967-17:46:21,1799) /usr/sbin/atd
(root,4064,544,00:00:00/967-17:46:21,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/967-17:46:21,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/967-17:46:21,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/967-17:46:21,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/967-17:46:21,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/967-17:46:21,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/967-17:46:21,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,530432,130384,00:00:00/1-15:00:13,6855) /usr/sbin/httpd
(apache,528636,126076,00:00:00/2-07:37:36,15270) /usr/sbin/httpd
(apache,530440,130356,00:00:00/2-07:37:36,15277) /usr/sbin/httpd
(apache,530440,130412,00:00:00/2-07:37:36,15284) /usr/sbin/httpd
(apache,530440,130420,00:00:00/2-07:37:35,15289) /usr/sbin/httpd
(apache,530440,130396,00:00:00/2-07:37:35,15296) /usr/sbin/httpd
(apache,530440,130444,00:00:00/2-07:37:35,15302) /usr/sbin/httpd
(apache,530440,130448,00:00:00/2-07:37:35,15307) /usr/sbin/httpd
(apache,530440,130392,00:00:00/2-07:37:35,15314) /usr/sbin/httpd
(apache,530440,130404,00:00:00/2-07:37:35,15321) /usr/sbin/httpd
(root,108468,1060,00:00:00/165-01:59:06,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/165-01:59:06,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/165-01:59:06,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17256,14:02:41/165-01:59:06,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/05:46:56,22334) [flush-253:5]
(postfix,80944,3360,00:00:00/49:34,24958) pickup -l -t fifo -u
(root,110268,1492,00:00:00/00:01,31096) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,31114) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,31115) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-01-31 16:26

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939ee4df6fd

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:13:06/956-18:12:08,1) /sbin/init
(root,0,0,00:00:02/956-18:12:08,2) [kthreadd]
(root,0,0,00:08:48/956-18:12:08,3) [migration/0]
(root,0,0,00:06:02/956-18:12:08,4) [ksoftirqd/0]
(root,0,0,00:00:00/956-18:12:08,5) [stopper/0]
(root,0,0,00:02:28/956-18:12:08,6) [watchdog/0]
(root,0,0,00:11:42/956-18:12:08,7) [migration/1]
(root,0,0,00:00:00/956-18:12:08,8) [stopper/1]
(root,0,0,00:03:31/956-18:12:08,9) [ksoftirqd/1]
(root,0,0,00:02:19/956-18:12:08,10) [watchdog/1]
(root,0,0,01:41:17/956-18:12:08,11) [events/0]
(root,0,0,01:45:07/956-18:12:08,12) [events/1]
(root,0,0,00:00:00/956-18:12:08,13) [cgroup]
(root,0,0,00:00:00/956-18:12:08,14) [khelper]
(root,0,0,00:00:00/956-18:12:08,15) [netns]
(root,0,0,00:00:00/956-18:12:08,16) [async/mgr]
(root,0,0,00:00:00/956-18:12:08,17) [pm]
(root,0,0,00:00:00/956-18:12:08,18) [xenwatch]
(root,0,0,00:00:00/956-18:12:08,19) [xenbus]
(root,0,0,00:05:23/956-18:12:08,20) [sync_supers]
(root,0,0,00:06:28/956-18:12:08,21) [bdi-default]
(root,0,0,00:00:00/956-18:12:08,22) [kintegrityd/0]
(root,0,0,00:00:00/956-18:12:08,23) [kintegrityd/1]
(root,0,0,00:05:14/956-18:12:08,24) [kblockd/0]
(root,0,0,00:01:04/956-18:12:08,25) [kblockd/1]
(root,0,0,00:00:00/956-18:12:08,26) [ata_aux]
(root,0,0,00:00:00/956-18:12:08,27) [ata_sff/0]
(root,0,0,00:00:00/956-18:12:08,28) [ata_sff/1]
(root,0,0,00:00:00/956-18:12:08,29) [ksuspend_usbd]
(root,0,0,00:00:00/956-18:12:08,30) [khubd]
(root,0,0,00:00:00/956-18:12:08,31) [kseriod]
(root,0,0,00:00:00/956-18:12:08,32) [md/0]
(root,0,0,00:00:00/956-18:12:08,33) [md/1]
(root,0,0,00:00:00/956-18:12:08,34) [md_misc/0]
(root,0,0,00:00:00/956-18:12:08,35) [md_misc/1]
(root,0,0,00:00:00/956-18:12:08,36) [linkwatch]
(root,0,0,00:00:30/956-18:12:08,37) [khungtaskd]
(root,0,0,00:00:00/956-18:12:08,38) [kswapd0]
(root,0,0,00:00:00/956-18:12:08,39) [ksmd]
(root,0,0,00:00:00/956-18:12:08,40) [aio/0]
(root,0,0,00:00:00/956-18:12:08,41) [aio/1]
(root,0,0,00:00:00/956-18:12:08,42) [crypto/0]
(root,0,0,00:00:00/956-18:12:08,43) [crypto/1]
(root,0,0,00:00:00/956-18:12:08,51) [kthrotld/0]
(root,0,0,00:00:00/956-18:12:08,52) [kthrotld/1]
(root,0,0,00:00:00/956-18:12:08,54) [khvcd]
(root,0,0,00:00:00/956-18:12:08,55) [kpsmoused]
(root,0,0,00:00:00/956-18:12:08,56) [usbhid_resumer]
(root,0,0,00:00:00/956-18:12:08,57) [deferwq]
(root,0,0,00:00:00/956-18:12:08,89) [kdmremove]
(root,0,0,00:00:00/956-18:12:08,90) [kstriped]
(root,0,0,00:00:00/956-18:12:03,233) [kdmflush]
(root,0,0,00:00:00/956-18:12:03,235) [kdmflush]
(root,0,0,00:00:16/956-18:11:50,252) [kjournald]
(root,10936,436,00:00:00/956-18:11:30,341) /sbin/udevd -d
(root,0,0,00:00:00/956-18:11:15,610) [kdmflush]
(root,0,0,00:00:00/956-18:11:15,613) [kdmflush]
(root,0,0,00:00:00/956-18:11:15,616) [kdmflush]
(root,0,0,00:00:00/956-18:11:15,621) [kdmflush]
(root,0,0,00:00:00/956-18:11:15,627) [kdmflush]
(root,10932,556,00:00:00/956-18:11:15,628) /sbin/udevd -d
(root,0,0,00:00:00/956-18:11:15,631) [kdmflush]
(root,10932,520,00:00:00/956-18:11:15,632) /sbin/udevd -d
(root,0,0,00:10:20/956-18:11:03,702) [flush-253:4]
(root,0,0,00:00:00/956-18:10:54,706) [kjournald]
(root,0,0,00:00:00/956-18:10:53,709) [xfs_mru_cache]
(root,0,0,00:05:43/956-18:10:53,710) [xfslogd/0]
(root,0,0,00:00:00/956-18:10:53,711) [xfslogd/1]
(root,0,0,00:07:23/956-18:10:53,712) [xfsdatad/0]
(root,0,0,00:00:00/956-18:10:53,713) [xfsdatad/1]
(root,0,0,00:00:00/956-18:10:53,714) [xfsconvertd/0]
(root,0,0,00:00:00/956-18:10:53,715) [xfsconvertd/1]
(root,0,0,00:00:08/956-18:10:53,716) [xfsalloc/0]
(root,0,0,00:00:22/956-18:10:53,717) [xfsalloc/1]
(root,0,0,00:00:08/956-18:10:53,718) [xfseofblocks/0]
(root,0,0,00:00:30/956-18:10:53,719) [xfseofblocks/1]
(root,0,0,00:00:00/956-18:10:53,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/956-18:10:53,721) [xfs-cil/dm-3]
(root,0,0,00:01:06/956-18:10:53,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/956-18:10:52,723) [xfsaild/dm-3]
(root,0,0,00:00:00/956-18:10:50,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/956-18:10:50,725) [xfs-cil/dm-2]
(root,0,0,00:01:07/956-18:10:50,726) [xfssyncd/dm-2]
(root,0,0,04:54:03/956-18:10:49,727) [xfsaild/dm-2]
(root,0,0,00:10:32/956-18:10:22,728) [kjournald]
(root,0,0,00:04:50/956-18:10:21,729) [xfsbufd/dm-5]
(root,0,0,00:03:05/956-18:10:21,730) [xfs-cil/dm-5]
(root,0,0,00:04:30/956-18:10:21,731) [xfssyncd/dm-5]
(root,0,0,06:45:37/956-18:10:21,732) [xfsaild/dm-5]
(root,0,0,00:00:02/956-18:10:19,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/956-18:10:19,734) [xfs-cil/dm-7]
(root,0,0,00:01:06/956-18:10:19,735) [xfssyncd/dm-7]
(root,0,0,04:55:45/956-18:10:19,736) [xfsaild/dm-7]
(root,0,0,00:00:00/956-18:10:17,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/956-18:10:17,738) [xfs-cil/dm-6]
(root,0,0,00:01:09/956-18:10:17,739) [xfssyncd/dm-6]
(root,0,0,04:56:07/956-18:10:17,740) [xfsaild/dm-6]
(root,0,0,00:30:21/956-18:09:58,816) [kauditd]
(root,93156,756,02:04:48/956-18:09:44,1154) auditd
(root,249864,5716,01:13:43/956-18:09:43,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:22/956-18:09:42,1195) rpcbind
(rpcuser,23404,1156,00:00:00/956-18:09:41,1215) rpc.statd
(dbus,21580,1040,00:00:04/956-18:09:39,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/956-18:09:37,1285) hald
(root,20400,956,00:00:00/956-18:09:37,1286) hald-runner
(root,452700,1544,00:22:48/956-18:09:31,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:36:28/956-18:09:26,1375) /usr/sbin/sshd
(root,21716,848,00:15:38/956-18:09:25,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:19:13/956-18:09:21,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:38/956-18:09:13,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:02/956-18:09:12,1555) qmgr -l -t fifo -u
(rabbitmq,10832,584,00:15:25/956-18:09:02,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/956-18:09:00,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/956-18:09:00,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/956-18:09:00,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424988,333152,5-22:57:20/956-18:09:00,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:39/956-18:08:40,1758) inet_gethost 4
(rabbitmq,17120,864,00:03:00/956-18:08:40,1759) inet_gethost 4
(root,112532,964,00:00:00/956-18:08:39,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,527052,135012,00:54:05/956-18:08:34,1776) /usr/sbin/httpd
(root,116864,1220,00:08:18/956-18:08:33,1786) crond
(root,21104,484,00:00:01/956-18:08:33,1799) /usr/sbin/atd
(root,4064,544,00:00:00/956-18:08:33,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/956-18:08:33,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/956-18:08:33,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/956-18:08:33,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/956-18:08:33,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/956-18:08:33,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/956-18:08:33,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,67568,3256,00:00:00/00:03,3008) sshd: [accepted] 
(sshd,67568,1568,00:00:00/00:03,3009) sshd: [net]      
(root,110268,1492,00:00:00/00:01,3123) /bin/bash /usr/bin/check_mk_agent
(root,13376,980,00:00:00/00:01,3141) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,3142) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(apache,528748,128788,00:00:00/3-03:22:27,5181) /usr/sbin/httpd
(apache,528748,128776,00:00:00/3-03:22:26,5184) /usr/sbin/httpd
(apache,528748,128736,00:00:00/3-03:22:26,5185) /usr/sbin/httpd
(apache,527052,124384,00:00:00/5-08:18:49,5434) /usr/sbin/httpd
(apache,528740,128820,00:00:00/5-08:18:49,5441) /usr/sbin/httpd
(apache,528748,128816,00:00:00/5-08:18:49,5446) /usr/sbin/httpd
(apache,528748,128792,00:00:00/5-08:18:49,5452) /usr/sbin/httpd
(apache,528748,128772,00:00:00/5-08:18:49,5458) /usr/sbin/httpd
(apache,528748,128824,00:00:00/5-08:18:49,5465) /usr/sbin/httpd
(apache,528748,128812,00:00:00/5-08:18:49,5470) /usr/sbin/httpd
(apache,528748,128812,00:00:00/5-08:18:49,5475) /usr/sbin/httpd
(apache,528748,128836,00:00:00/5-08:18:49,5482) /usr/sbin/httpd
(root,108468,1060,00:00:00/154-02:21:18,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/154-02:21:18,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/154-02:21:18,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17312,13:05:50/154-02:21:18,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(root,0,0,00:00:00/01:39:02,22612) [flush-253:5]
(postfix,80944,3368,00:00:00/45:06,29962) pickup -l -t fifo -u
(apache,528740,128812,00:00:00/5-00:46:19,30976) /usr/sbin/httpd

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2023-01-20 16:49

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939005cbc3e

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:12:51/929-16:22:21,1) /sbin/init
(root,0,0,00:00:02/929-16:22:21,2) [kthreadd]
(root,0,0,00:08:33/929-16:22:21,3) [migration/0]
(root,0,0,00:05:44/929-16:22:21,4) [ksoftirqd/0]
(root,0,0,00:00:00/929-16:22:21,5) [stopper/0]
(root,0,0,00:02:24/929-16:22:21,6) [watchdog/0]
(root,0,0,00:11:23/929-16:22:21,7) [migration/1]
(root,0,0,00:00:00/929-16:22:21,8) [stopper/1]
(root,0,0,00:03:22/929-16:22:21,9) [ksoftirqd/1]
(root,0,0,00:02:15/929-16:22:21,10) [watchdog/1]
(root,0,0,01:38:18/929-16:22:21,11) [events/0]
(root,0,0,01:42:08/929-16:22:21,12) [events/1]
(root,0,0,00:00:00/929-16:22:21,13) [cgroup]
(root,0,0,00:00:00/929-16:22:21,14) [khelper]
(root,0,0,00:00:00/929-16:22:21,15) [netns]
(root,0,0,00:00:00/929-16:22:21,16) [async/mgr]
(root,0,0,00:00:00/929-16:22:21,17) [pm]
(root,0,0,00:00:00/929-16:22:21,18) [xenwatch]
(root,0,0,00:00:00/929-16:22:21,19) [xenbus]
(root,0,0,00:05:14/929-16:22:21,20) [sync_supers]
(root,0,0,00:06:17/929-16:22:21,21) [bdi-default]
(root,0,0,00:00:00/929-16:22:21,22) [kintegrityd/0]
(root,0,0,00:00:00/929-16:22:21,23) [kintegrityd/1]
(root,0,0,00:05:06/929-16:22:21,24) [kblockd/0]
(root,0,0,00:01:02/929-16:22:21,25) [kblockd/1]
(root,0,0,00:00:00/929-16:22:21,26) [ata_aux]
(root,0,0,00:00:00/929-16:22:21,27) [ata_sff/0]
(root,0,0,00:00:00/929-16:22:21,28) [ata_sff/1]
(root,0,0,00:00:00/929-16:22:21,29) [ksuspend_usbd]
(root,0,0,00:00:00/929-16:22:21,30) [khubd]
(root,0,0,00:00:00/929-16:22:21,31) [kseriod]
(root,0,0,00:00:00/929-16:22:21,32) [md/0]
(root,0,0,00:00:00/929-16:22:21,33) [md/1]
(root,0,0,00:00:00/929-16:22:21,34) [md_misc/0]
(root,0,0,00:00:00/929-16:22:21,35) [md_misc/1]
(root,0,0,00:00:00/929-16:22:21,36) [linkwatch]
(root,0,0,00:00:29/929-16:22:21,37) [khungtaskd]
(root,0,0,00:00:00/929-16:22:21,38) [kswapd0]
(root,0,0,00:00:00/929-16:22:21,39) [ksmd]
(root,0,0,00:00:00/929-16:22:21,40) [aio/0]
(root,0,0,00:00:00/929-16:22:21,41) [aio/1]
(root,0,0,00:00:00/929-16:22:21,42) [crypto/0]
(root,0,0,00:00:00/929-16:22:21,43) [crypto/1]
(root,0,0,00:00:00/929-16:22:21,51) [kthrotld/0]
(root,0,0,00:00:00/929-16:22:21,52) [kthrotld/1]
(root,0,0,00:00:00/929-16:22:21,54) [khvcd]
(root,0,0,00:00:00/929-16:22:21,55) [kpsmoused]
(root,0,0,00:00:00/929-16:22:21,56) [usbhid_resumer]
(root,0,0,00:00:00/929-16:22:21,57) [deferwq]
(root,0,0,00:00:00/929-16:22:21,89) [kdmremove]
(root,0,0,00:00:00/929-16:22:21,90) [kstriped]
(root,0,0,00:00:00/929-16:22:16,233) [kdmflush]
(root,0,0,00:00:00/929-16:22:16,235) [kdmflush]
(root,0,0,00:00:15/929-16:22:03,252) [kjournald]
(root,10936,436,00:00:00/929-16:21:43,341) /sbin/udevd -d
(root,0,0,00:00:00/929-16:21:28,610) [kdmflush]
(root,0,0,00:00:00/929-16:21:28,613) [kdmflush]
(root,0,0,00:00:00/929-16:21:28,616) [kdmflush]
(root,0,0,00:00:00/929-16:21:28,621) [kdmflush]
(root,0,0,00:00:00/929-16:21:28,627) [kdmflush]
(root,10932,556,00:00:00/929-16:21:28,628) /sbin/udevd -d
(root,0,0,00:00:00/929-16:21:28,631) [kdmflush]
(root,10932,520,00:00:00/929-16:21:28,632) /sbin/udevd -d
(root,0,0,00:10:01/929-16:21:16,702) [flush-253:4]
(root,0,0,00:00:00/929-16:21:07,706) [kjournald]
(root,0,0,00:00:00/929-16:21:06,709) [xfs_mru_cache]
(root,0,0,00:05:34/929-16:21:06,710) [xfslogd/0]
(root,0,0,00:00:00/929-16:21:06,711) [xfslogd/1]
(root,0,0,00:07:13/929-16:21:06,712) [xfsdatad/0]
(root,0,0,00:00:00/929-16:21:06,713) [xfsdatad/1]
(root,0,0,00:00:00/929-16:21:06,714) [xfsconvertd/0]
(root,0,0,00:00:00/929-16:21:06,715) [xfsconvertd/1]
(root,0,0,00:00:08/929-16:21:06,716) [xfsalloc/0]
(root,0,0,00:00:21/929-16:21:06,717) [xfsalloc/1]
(root,0,0,00:00:07/929-16:21:06,718) [xfseofblocks/0]
(root,0,0,00:00:29/929-16:21:06,719) [xfseofblocks/1]
(root,0,0,00:00:00/929-16:21:06,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/929-16:21:06,721) [xfs-cil/dm-3]
(root,0,0,00:01:04/929-16:21:06,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/929-16:21:05,723) [xfsaild/dm-3]
(root,0,0,00:00:00/929-16:21:03,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/929-16:21:03,725) [xfs-cil/dm-2]
(root,0,0,00:01:05/929-16:21:03,726) [xfssyncd/dm-2]
(root,0,0,04:44:41/929-16:21:02,727) [xfsaild/dm-2]
(root,0,0,00:10:14/929-16:20:35,728) [kjournald]
(root,0,0,00:04:42/929-16:20:34,729) [xfsbufd/dm-5]
(root,0,0,00:03:01/929-16:20:34,730) [xfs-cil/dm-5]
(root,0,0,00:04:22/929-16:20:34,731) [xfssyncd/dm-5]
(root,0,0,06:34:00/929-16:20:34,732) [xfsaild/dm-5]
(root,0,0,00:00:02/929-16:20:32,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/929-16:20:32,734) [xfs-cil/dm-7]
(root,0,0,00:01:04/929-16:20:32,735) [xfssyncd/dm-7]
(root,0,0,04:46:24/929-16:20:32,736) [xfsaild/dm-7]
(root,0,0,00:00:00/929-16:20:30,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/929-16:20:30,738) [xfs-cil/dm-6]
(root,0,0,00:01:07/929-16:20:30,739) [xfssyncd/dm-6]
(root,0,0,04:46:45/929-16:20:30,740) [xfsaild/dm-6]
(root,0,0,00:29:46/929-16:20:11,816) [kauditd]
(root,93156,756,02:02:22/929-16:19:57,1154) auditd
(root,249864,5716,01:12:19/929-16:19:56,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:18/929-16:19:55,1195) rpcbind
(rpcuser,23404,1156,00:00:00/929-16:19:54,1215) rpc.statd
(dbus,21580,1040,00:00:04/929-16:19:52,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/929-16:19:50,1285) hald
(root,20400,956,00:00:00/929-16:19:50,1286) hald-runner
(root,452700,1544,00:22:09/929-16:19:44,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:33:40/929-16:19:39,1375) /usr/sbin/sshd
(root,21716,848,00:15:11/929-16:19:38,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:18:40/929-16:19:34,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:27/929-16:19:26,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:01:00/929-16:19:25,1555) qmgr -l -t fifo -u
(rabbitmq,10832,580,00:14:58/929-16:19:15,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/929-16:19:13,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/929-16:19:13,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/929-16:19:13,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424988,332396,5-18:54:23/929-16:19:13,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:36/929-16:18:53,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:54/929-16:18:53,1759) inet_gethost 4
(root,112532,964,00:00:00/929-16:18:52,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,523616,131624,00:52:27/929-16:18:47,1776) /usr/sbin/httpd
(root,116864,1220,00:08:03/929-16:18:46,1786) crond
(root,21104,484,00:00:01/929-16:18:46,1799) /usr/sbin/atd
(root,4064,544,00:00:00/929-16:18:46,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/929-16:18:46,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/929-16:18:46,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/929-16:18:46,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/929-16:18:46,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/929-16:18:46,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/929-16:18:46,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,525348,125316,00:00:00/2-07:00:10,2067) /usr/sbin/httpd
(apache,525360,125324,00:00:00/2-07:00:09,2072) /usr/sbin/httpd
(apache,525348,125312,00:00:00/2-07:00:09,2073) /usr/sbin/httpd
(apache,525348,125624,00:00:00/2-07:00:08,2076) /usr/sbin/httpd
(apache,525348,125276,00:00:00/2-07:00:08,2078) /usr/sbin/httpd
(apache,525348,125288,00:00:00/2-07:00:08,2079) /usr/sbin/httpd
(apache,525360,125296,00:00:00/2-07:00:07,2080) /usr/sbin/httpd
(root,66224,3104,00:00:00/00:02,10669) sshd: [accepted] 
(root,110268,1492,00:00:00/00:01,10770) /bin/bash /usr/bin/check_mk_agent
(root,13372,972,00:00:00/00:01,10788) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,10789) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:13/19-19:23:12,16127) [flush-253:5]
(apache,525348,125456,00:00:00/5-21:37:35,16485) /usr/sbin/httpd
(apache,525360,125464,00:00:00/5-21:37:34,16486) /usr/sbin/httpd
(apache,525360,125752,00:00:00/5-21:37:34,16487) /usr/sbin/httpd
(apache,523616,120996,00:00:00/6-06:11:05,20499) /usr/sbin/httpd
(apache,525360,125488,00:00:00/6-06:11:05,20506) /usr/sbin/httpd
(apache,525480,125788,00:00:00/6-06:11:05,20512) /usr/sbin/httpd
(apache,525348,125788,00:00:00/6-06:11:05,20519) /usr/sbin/httpd
(apache,525352,125424,00:00:00/6-06:11:04,20524) /usr/sbin/httpd
(apache,525348,125776,00:00:00/6-06:11:04,20529) /usr/sbin/httpd
(apache,525360,125484,00:00:00/6-06:11:04,20536) /usr/sbin/httpd
(apache,525348,125472,00:00:00/6-06:11:04,20543) /usr/sbin/httpd
(apache,525360,125440,00:00:00/6-06:11:04,20548) /usr/sbin/httpd
(root,108468,1060,00:00:00/127-00:31:31,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/127-00:31:31,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/127-00:31:31,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17256,10:45:59/127-00:31:31,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/01:28:54,31503) pickup -l -t fifo -u

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-12-24 14:59

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939381c75f2

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:12:43/916-12:40:29,1) /sbin/init
(root,0,0,00:00:02/916-12:40:29,2) [kthreadd]
(root,0,0,00:08:25/916-12:40:29,3) [migration/0]
(root,0,0,00:05:35/916-12:40:29,4) [ksoftirqd/0]
(root,0,0,00:00:00/916-12:40:29,5) [stopper/0]
(root,0,0,00:02:22/916-12:40:29,6) [watchdog/0]
(root,0,0,00:11:13/916-12:40:29,7) [migration/1]
(root,0,0,00:00:00/916-12:40:29,8) [stopper/1]
(root,0,0,00:03:17/916-12:40:29,9) [ksoftirqd/1]
(root,0,0,00:02:14/916-12:40:29,10) [watchdog/1]
(root,0,0,01:36:53/916-12:40:29,11) [events/0]
(root,0,0,01:40:40/916-12:40:29,12) [events/1]
(root,0,0,00:00:00/916-12:40:29,13) [cgroup]
(root,0,0,00:00:00/916-12:40:29,14) [khelper]
(root,0,0,00:00:00/916-12:40:29,15) [netns]
(root,0,0,00:00:00/916-12:40:29,16) [async/mgr]
(root,0,0,00:00:00/916-12:40:29,17) [pm]
(root,0,0,00:00:00/916-12:40:29,18) [xenwatch]
(root,0,0,00:00:00/916-12:40:29,19) [xenbus]
(root,0,0,00:05:09/916-12:40:29,20) [sync_supers]
(root,0,0,00:06:12/916-12:40:29,21) [bdi-default]
(root,0,0,00:00:00/916-12:40:29,22) [kintegrityd/0]
(root,0,0,00:00:00/916-12:40:29,23) [kintegrityd/1]
(root,0,0,00:05:02/916-12:40:29,24) [kblockd/0]
(root,0,0,00:01:01/916-12:40:29,25) [kblockd/1]
(root,0,0,00:00:00/916-12:40:29,26) [ata_aux]
(root,0,0,00:00:00/916-12:40:29,27) [ata_sff/0]
(root,0,0,00:00:00/916-12:40:29,28) [ata_sff/1]
(root,0,0,00:00:00/916-12:40:29,29) [ksuspend_usbd]
(root,0,0,00:00:00/916-12:40:29,30) [khubd]
(root,0,0,00:00:00/916-12:40:29,31) [kseriod]
(root,0,0,00:00:00/916-12:40:29,32) [md/0]
(root,0,0,00:00:00/916-12:40:29,33) [md/1]
(root,0,0,00:00:00/916-12:40:29,34) [md_misc/0]
(root,0,0,00:00:00/916-12:40:29,35) [md_misc/1]
(root,0,0,00:00:00/916-12:40:29,36) [linkwatch]
(root,0,0,00:00:29/916-12:40:29,37) [khungtaskd]
(root,0,0,00:00:00/916-12:40:29,38) [kswapd0]
(root,0,0,00:00:00/916-12:40:29,39) [ksmd]
(root,0,0,00:00:00/916-12:40:29,40) [aio/0]
(root,0,0,00:00:00/916-12:40:29,41) [aio/1]
(root,0,0,00:00:00/916-12:40:29,42) [crypto/0]
(root,0,0,00:00:00/916-12:40:29,43) [crypto/1]
(root,0,0,00:00:00/916-12:40:29,51) [kthrotld/0]
(root,0,0,00:00:00/916-12:40:29,52) [kthrotld/1]
(root,0,0,00:00:00/916-12:40:29,54) [khvcd]
(root,0,0,00:00:00/916-12:40:29,55) [kpsmoused]
(root,0,0,00:00:00/916-12:40:29,56) [usbhid_resumer]
(root,0,0,00:00:00/916-12:40:29,57) [deferwq]
(root,0,0,00:00:00/916-12:40:29,89) [kdmremove]
(root,0,0,00:00:00/916-12:40:29,90) [kstriped]
(root,0,0,00:00:00/916-12:40:24,233) [kdmflush]
(root,0,0,00:00:00/916-12:40:24,235) [kdmflush]
(root,0,0,00:00:15/916-12:40:11,252) [kjournald]
(root,10936,436,00:00:00/916-12:39:51,341) /sbin/udevd -d
(root,0,0,00:00:00/916-12:39:36,610) [kdmflush]
(root,0,0,00:00:00/916-12:39:36,613) [kdmflush]
(root,0,0,00:00:00/916-12:39:36,616) [kdmflush]
(root,0,0,00:00:00/916-12:39:36,621) [kdmflush]
(root,0,0,00:00:00/916-12:39:36,627) [kdmflush]
(root,10932,556,00:00:00/916-12:39:36,628) /sbin/udevd -d
(root,0,0,00:00:00/916-12:39:36,631) [kdmflush]
(root,10932,520,00:00:00/916-12:39:36,632) /sbin/udevd -d
(root,0,0,00:09:53/916-12:39:24,702) [flush-253:4]
(root,0,0,00:00:00/916-12:39:15,706) [kjournald]
(root,0,0,00:00:00/916-12:39:14,709) [xfs_mru_cache]
(root,0,0,00:05:30/916-12:39:14,710) [xfslogd/0]
(root,0,0,00:00:00/916-12:39:14,711) [xfslogd/1]
(root,0,0,00:07:08/916-12:39:14,712) [xfsdatad/0]
(root,0,0,00:00:00/916-12:39:14,713) [xfsdatad/1]
(root,0,0,00:00:00/916-12:39:14,714) [xfsconvertd/0]
(root,0,0,00:00:00/916-12:39:14,715) [xfsconvertd/1]
(root,0,0,00:00:08/916-12:39:14,716) [xfsalloc/0]
(root,0,0,00:00:21/916-12:39:14,717) [xfsalloc/1]
(root,0,0,00:00:07/916-12:39:14,718) [xfseofblocks/0]
(root,0,0,00:00:29/916-12:39:14,719) [xfseofblocks/1]
(root,0,0,00:00:00/916-12:39:14,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/916-12:39:14,721) [xfs-cil/dm-3]
(root,0,0,00:01:03/916-12:39:14,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/916-12:39:13,723) [xfsaild/dm-3]
(root,0,0,00:00:00/916-12:39:11,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/916-12:39:11,725) [xfs-cil/dm-2]
(root,0,0,00:01:04/916-12:39:11,726) [xfssyncd/dm-2]
(root,0,0,04:40:13/916-12:39:10,727) [xfsaild/dm-2]
(root,0,0,00:10:05/916-12:38:43,728) [kjournald]
(root,0,0,00:04:38/916-12:38:42,729) [xfsbufd/dm-5]
(root,0,0,00:02:59/916-12:38:42,730) [xfs-cil/dm-5]
(root,0,0,00:04:18/916-12:38:42,731) [xfssyncd/dm-5]
(root,0,0,06:28:22/916-12:38:42,732) [xfsaild/dm-5]
(root,0,0,00:00:02/916-12:38:40,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/916-12:38:40,734) [xfs-cil/dm-7]
(root,0,0,00:01:03/916-12:38:40,735) [xfssyncd/dm-7]
(root,0,0,04:41:50/916-12:38:40,736) [xfsaild/dm-7]
(root,0,0,00:00:00/916-12:38:38,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/916-12:38:38,738) [xfs-cil/dm-6]
(root,0,0,00:01:06/916-12:38:38,739) [xfssyncd/dm-6]
(root,0,0,04:42:10/916-12:38:38,740) [xfsaild/dm-6]
(root,0,0,00:29:27/916-12:38:19,816) [kauditd]
(root,93156,756,02:01:04/916-12:38:05,1154) auditd
(root,249864,5716,01:11:34/916-12:38:04,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:16/916-12:38:03,1195) rpcbind
(rpcuser,23404,1156,00:00:00/916-12:38:02,1215) rpc.statd
(dbus,21580,1040,00:00:04/916-12:38:00,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/916-12:37:58,1285) hald
(root,20400,956,00:00:00/916-12:37:58,1286) hald-runner
(root,452700,1544,00:21:50/916-12:37:52,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:32:09/916-12:37:47,1375) /usr/sbin/sshd
(root,21716,848,00:14:58/916-12:37:46,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:18:25/916-12:37:42,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:21/916-12:37:34,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:00:59/916-12:37:33,1555) qmgr -l -t fifo -u
(rabbitmq,10832,580,00:14:46/916-12:37:23,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/916-12:37:21,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/916-12:37:21,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/916-12:37:21,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1425636,332496,5-16:55:54/916-12:37:21,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:35/916-12:37:01,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:52/916-12:37:01,1759) inet_gethost 4
(root,112532,964,00:00:00/916-12:37:00,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,522824,130780,00:51:39/916-12:36:55,1776) /usr/sbin/httpd
(root,116864,1220,00:07:56/916-12:36:54,1786) crond
(root,21104,484,00:00:01/916-12:36:54,1799) /usr/sbin/atd
(root,4064,544,00:00:00/916-12:36:54,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/916-12:36:54,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/916-12:36:54,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/916-12:36:54,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/916-12:36:54,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/916-12:36:54,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/916-12:36:54,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,522824,120152,00:00:00/02:57:11,10329) /usr/sbin/httpd
(apache,524516,124328,00:00:00/02:57:11,10337) /usr/sbin/httpd
(apache,524516,124376,00:00:00/02:57:11,10342) /usr/sbin/httpd
(apache,524516,124228,00:00:00/02:57:11,10347) /usr/sbin/httpd
(apache,524516,124112,00:00:00/02:57:11,10354) /usr/sbin/httpd
(apache,524516,124332,00:00:00/02:57:11,10359) /usr/sbin/httpd
(apache,524516,124324,00:00:00/02:57:11,10365) /usr/sbin/httpd
(apache,524516,124184,00:00:00/02:57:10,10370) /usr/sbin/httpd
(apache,524516,124232,00:00:00/02:57:10,10376) /usr/sbin/httpd
(root,0,0,00:00:04/6-15:41:20,16127) [flush-253:5]
(root,108468,1060,00:00:00/113-20:49:39,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/113-20:49:39,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/113-20:49:39,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17780,09:37:40/113-20:49:39,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3372,00:00:00/01:03:12,24277) pickup -l -t fifo -u
(root,110268,1488,00:00:00/00:01,32202) /bin/bash /usr/bin/check_mk_agent
(root,13376,972,00:00:00/00:01,32220) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:01,32221) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-12-11 11:17

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939b345a9ed

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:12:24/892-21:12:52,1) /sbin/init
(root,0,0,00:00:02/892-21:12:52,2) [kthreadd]
(root,0,0,00:08:12/892-21:12:52,3) [migration/0]
(root,0,0,00:05:19/892-21:12:52,4) [ksoftirqd/0]
(root,0,0,00:00:00/892-21:12:52,5) [stopper/0]
(root,0,0,00:02:18/892-21:12:52,6) [watchdog/0]
(root,0,0,00:10:55/892-21:12:52,7) [migration/1]
(root,0,0,00:00:00/892-21:12:52,8) [stopper/1]
(root,0,0,00:03:09/892-21:12:52,9) [ksoftirqd/1]
(root,0,0,00:02:10/892-21:12:52,10) [watchdog/1]
(root,0,0,01:34:21/892-21:12:52,11) [events/0]
(root,0,0,01:38:06/892-21:12:52,12) [events/1]
(root,0,0,00:00:00/892-21:12:52,13) [cgroup]
(root,0,0,00:00:00/892-21:12:52,14) [khelper]
(root,0,0,00:00:00/892-21:12:52,15) [netns]
(root,0,0,00:00:00/892-21:12:52,16) [async/mgr]
(root,0,0,00:00:00/892-21:12:52,17) [pm]
(root,0,0,00:00:00/892-21:12:52,18) [xenwatch]
(root,0,0,00:00:00/892-21:12:52,19) [xenbus]
(root,0,0,00:05:01/892-21:12:52,20) [sync_supers]
(root,0,0,00:06:02/892-21:12:52,21) [bdi-default]
(root,0,0,00:00:00/892-21:12:52,22) [kintegrityd/0]
(root,0,0,00:00:00/892-21:12:52,23) [kintegrityd/1]
(root,0,0,00:04:54/892-21:12:52,24) [kblockd/0]
(root,0,0,00:00:59/892-21:12:52,25) [kblockd/1]
(root,0,0,00:00:00/892-21:12:52,26) [ata_aux]
(root,0,0,00:00:00/892-21:12:52,27) [ata_sff/0]
(root,0,0,00:00:00/892-21:12:52,28) [ata_sff/1]
(root,0,0,00:00:00/892-21:12:52,29) [ksuspend_usbd]
(root,0,0,00:00:00/892-21:12:52,30) [khubd]
(root,0,0,00:00:00/892-21:12:52,31) [kseriod]
(root,0,0,00:00:00/892-21:12:52,32) [md/0]
(root,0,0,00:00:00/892-21:12:52,33) [md/1]
(root,0,0,00:00:00/892-21:12:52,34) [md_misc/0]
(root,0,0,00:00:00/892-21:12:52,35) [md_misc/1]
(root,0,0,00:00:00/892-21:12:52,36) [linkwatch]
(root,0,0,00:00:28/892-21:12:52,37) [khungtaskd]
(root,0,0,00:00:00/892-21:12:52,38) [kswapd0]
(root,0,0,00:00:00/892-21:12:52,39) [ksmd]
(root,0,0,00:00:00/892-21:12:52,40) [aio/0]
(root,0,0,00:00:00/892-21:12:52,41) [aio/1]
(root,0,0,00:00:00/892-21:12:52,42) [crypto/0]
(root,0,0,00:00:00/892-21:12:52,43) [crypto/1]
(root,0,0,00:00:00/892-21:12:52,51) [kthrotld/0]
(root,0,0,00:00:00/892-21:12:52,52) [kthrotld/1]
(root,0,0,00:00:00/892-21:12:52,54) [khvcd]
(root,0,0,00:00:00/892-21:12:52,55) [kpsmoused]
(root,0,0,00:00:00/892-21:12:52,56) [usbhid_resumer]
(root,0,0,00:00:00/892-21:12:52,57) [deferwq]
(root,0,0,00:00:00/892-21:12:52,89) [kdmremove]
(root,0,0,00:00:00/892-21:12:52,90) [kstriped]
(root,0,0,00:00:00/892-21:12:47,233) [kdmflush]
(root,0,0,00:00:00/892-21:12:47,235) [kdmflush]
(root,0,0,00:00:14/892-21:12:34,252) [kjournald]
(root,10936,436,00:00:00/892-21:12:14,341) /sbin/udevd -d
(root,0,0,00:00:00/892-21:11:59,610) [kdmflush]
(root,0,0,00:00:00/892-21:11:59,613) [kdmflush]
(root,0,0,00:00:00/892-21:11:59,616) [kdmflush]
(root,0,0,00:00:00/892-21:11:59,621) [kdmflush]
(root,0,0,00:00:00/892-21:11:59,627) [kdmflush]
(root,10932,556,00:00:00/892-21:11:59,628) /sbin/udevd -d
(root,0,0,00:00:00/892-21:11:59,631) [kdmflush]
(root,10932,520,00:00:00/892-21:11:59,632) /sbin/udevd -d
(root,0,0,00:09:38/892-21:11:47,702) [flush-253:4]
(root,0,0,00:00:00/892-21:11:38,706) [kjournald]
(root,0,0,00:00:00/892-21:11:37,709) [xfs_mru_cache]
(root,0,0,00:05:22/892-21:11:37,710) [xfslogd/0]
(root,0,0,00:00:00/892-21:11:37,711) [xfslogd/1]
(root,0,0,00:06:57/892-21:11:37,712) [xfsdatad/0]
(root,0,0,00:00:00/892-21:11:37,713) [xfsdatad/1]
(root,0,0,00:00:00/892-21:11:37,714) [xfsconvertd/0]
(root,0,0,00:00:00/892-21:11:37,715) [xfsconvertd/1]
(root,0,0,00:00:07/892-21:11:37,716) [xfsalloc/0]
(root,0,0,00:00:20/892-21:11:37,717) [xfsalloc/1]
(root,0,0,00:00:07/892-21:11:37,718) [xfseofblocks/0]
(root,0,0,00:00:28/892-21:11:37,719) [xfseofblocks/1]
(root,0,0,00:00:00/892-21:11:37,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/892-21:11:37,721) [xfs-cil/dm-3]
(root,0,0,00:01:01/892-21:11:37,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/892-21:11:36,723) [xfsaild/dm-3]
(root,0,0,00:00:00/892-21:11:34,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/892-21:11:34,725) [xfs-cil/dm-2]
(root,0,0,00:01:02/892-21:11:34,726) [xfssyncd/dm-2]
(root,0,0,04:32:01/892-21:11:33,727) [xfsaild/dm-2]
(root,0,0,00:09:49/892-21:11:06,728) [kjournald]
(root,0,0,00:04:31/892-21:11:05,729) [xfsbufd/dm-5]
(root,0,0,00:02:54/892-21:11:05,730) [xfs-cil/dm-5]
(root,0,0,00:04:11/892-21:11:05,731) [xfssyncd/dm-5]
(root,0,0,06:18:20/892-21:11:05,732) [xfsaild/dm-5]
(root,0,0,00:00:02/892-21:11:03,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/892-21:11:03,734) [xfs-cil/dm-7]
(root,0,0,00:01:01/892-21:11:03,735) [xfssyncd/dm-7]
(root,0,0,04:33:42/892-21:11:03,736) [xfsaild/dm-7]
(root,0,0,00:00:00/892-21:11:01,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/892-21:11:01,738) [xfs-cil/dm-6]
(root,0,0,00:01:04/892-21:11:01,739) [xfssyncd/dm-6]
(root,0,0,04:33:54/892-21:11:01,740) [xfsaild/dm-6]
(root,0,0,00:28:44/892-21:10:42,816) [kauditd]
(root,93156,756,01:58:13/892-21:10:28,1154) auditd
(root,249864,5716,01:09:57/892-21:10:27,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:13/892-21:10:26,1195) rpcbind
(rpcuser,23404,1156,00:00:00/892-21:10:25,1215) rpc.statd
(dbus,21580,1040,00:00:04/892-21:10:23,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/892-21:10:21,1285) hald
(root,20400,956,00:00:00/892-21:10:21,1286) hald-runner
(root,452700,1544,00:21:17/892-21:10:15,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:28:41/892-21:10:10,1375) /usr/sbin/sshd
(root,21716,848,00:14:35/892-21:10:09,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:17:56/892-21:10:05,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:11/892-21:09:57,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:00:58/892-21:09:56,1555) qmgr -l -t fifo -u
(rabbitmq,10832,576,00:14:23/892-21:09:46,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/892-21:09:44,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/892-21:09:44,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/892-21:09:44,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1425308,332124,5-13:23:30/892-21:09:44,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:33/892-21:09:24,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:47/892-21:09:24,1759) inet_gethost 4
(root,112532,964,00:00:00/892-21:09:23,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,519384,127396,00:50:15/892-21:09:18,1776) /usr/sbin/httpd
(root,116864,1220,00:07:44/892-21:09:17,1786) crond
(root,21104,484,00:00:00/892-21:09:17,1799) /usr/sbin/atd
(root,4064,544,00:00:00/892-21:09:17,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/892-21:09:17,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/892-21:09:17,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/892-21:09:17,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/892-21:09:17,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/892-21:09:17,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/892-21:09:17,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(postfix,80944,3360,00:00:00/44:41,4370) pickup -l -t fifo -u
(apache,519384,116768,00:00:00/4-11:09:35,5469) /usr/sbin/httpd
(apache,521124,121152,00:00:00/4-11:09:35,5470) /usr/sbin/httpd
(apache,521120,121184,00:00:00/4-11:09:35,5471) /usr/sbin/httpd
(apache,521132,121184,00:00:00/4-11:09:35,5473) /usr/sbin/httpd
(apache,521132,121168,00:00:00/4-11:09:35,5474) /usr/sbin/httpd
(apache,521124,121188,00:00:00/4-11:09:35,5475) /usr/sbin/httpd
(apache,521124,121120,00:00:00/4-11:09:34,5485) /usr/sbin/httpd
(apache,521124,121148,00:00:00/4-11:09:34,5486) /usr/sbin/httpd
(apache,521124,121192,00:00:00/4-11:09:34,5488) /usr/sbin/httpd
(apache,521124,121124,00:00:00/3-21:49:20,6200) /usr/sbin/httpd
(apache,521132,121088,00:00:00/3-21:49:19,6297) /usr/sbin/httpd
(apache,521124,121124,00:00:00/3-21:49:19,6299) /usr/sbin/httpd
(apache,521132,121104,00:00:00/3-21:49:18,6309) /usr/sbin/httpd
(apache,521124,121128,00:00:00/3-21:49:18,6310) /usr/sbin/httpd
(apache,521124,121152,00:00:00/3-21:49:18,6311) /usr/sbin/httpd
(apache,521124,121112,00:00:00/3-21:49:18,6312) /usr/sbin/httpd
(root,110268,1492,00:00:00/00:00,9957) /bin/bash /usr/bin/check_mk_agent
(root,13376,980,00:00:00/00:00,9975) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,800,00:00:00/00:00,9976) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:19/28-20:19:49,13806) [flush-253:5]
(root,108468,1060,00:00:00/90-05:22:02,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/90-05:22:02,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/90-05:22:02,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,18032,07:36:02/90-05:22:02,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-11-17 19:49

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939d2f51f00

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:12:17/880-08:08:03,1) /sbin/init
(root,0,0,00:00:02/880-08:08:03,2) [kthreadd]
(root,0,0,00:08:05/880-08:08:03,3) [migration/0]
(root,0,0,00:05:11/880-08:08:03,4) [ksoftirqd/0]
(root,0,0,00:00:00/880-08:08:03,5) [stopper/0]
(root,0,0,00:02:16/880-08:08:03,6) [watchdog/0]
(root,0,0,00:10:46/880-08:08:03,7) [migration/1]
(root,0,0,00:00:00/880-08:08:03,8) [stopper/1]
(root,0,0,00:03:05/880-08:08:03,9) [ksoftirqd/1]
(root,0,0,00:02:08/880-08:08:03,10) [watchdog/1]
(root,0,0,01:33:01/880-08:08:03,11) [events/0]
(root,0,0,01:36:43/880-08:08:03,12) [events/1]
(root,0,0,00:00:00/880-08:08:03,13) [cgroup]
(root,0,0,00:00:00/880-08:08:03,14) [khelper]
(root,0,0,00:00:00/880-08:08:03,15) [netns]
(root,0,0,00:00:00/880-08:08:03,16) [async/mgr]
(root,0,0,00:00:00/880-08:08:03,17) [pm]
(root,0,0,00:00:00/880-08:08:03,18) [xenwatch]
(root,0,0,00:00:00/880-08:08:03,19) [xenbus]
(root,0,0,00:04:57/880-08:08:03,20) [sync_supers]
(root,0,0,00:05:57/880-08:08:03,21) [bdi-default]
(root,0,0,00:00:00/880-08:08:03,22) [kintegrityd/0]
(root,0,0,00:00:00/880-08:08:03,23) [kintegrityd/1]
(root,0,0,00:04:51/880-08:08:03,24) [kblockd/0]
(root,0,0,00:00:58/880-08:08:03,25) [kblockd/1]
(root,0,0,00:00:00/880-08:08:03,26) [ata_aux]
(root,0,0,00:00:00/880-08:08:03,27) [ata_sff/0]
(root,0,0,00:00:00/880-08:08:03,28) [ata_sff/1]
(root,0,0,00:00:00/880-08:08:03,29) [ksuspend_usbd]
(root,0,0,00:00:00/880-08:08:03,30) [khubd]
(root,0,0,00:00:00/880-08:08:03,31) [kseriod]
(root,0,0,00:00:00/880-08:08:03,32) [md/0]
(root,0,0,00:00:00/880-08:08:03,33) [md/1]
(root,0,0,00:00:00/880-08:08:03,34) [md_misc/0]
(root,0,0,00:00:00/880-08:08:03,35) [md_misc/1]
(root,0,0,00:00:00/880-08:08:03,36) [linkwatch]
(root,0,0,00:00:28/880-08:08:03,37) [khungtaskd]
(root,0,0,00:00:00/880-08:08:03,38) [kswapd0]
(root,0,0,00:00:00/880-08:08:03,39) [ksmd]
(root,0,0,00:00:00/880-08:08:03,40) [aio/0]
(root,0,0,00:00:00/880-08:08:03,41) [aio/1]
(root,0,0,00:00:00/880-08:08:03,42) [crypto/0]
(root,0,0,00:00:00/880-08:08:03,43) [crypto/1]
(root,0,0,00:00:00/880-08:08:03,51) [kthrotld/0]
(root,0,0,00:00:00/880-08:08:03,52) [kthrotld/1]
(root,0,0,00:00:00/880-08:08:03,54) [khvcd]
(root,0,0,00:00:00/880-08:08:03,55) [kpsmoused]
(root,0,0,00:00:00/880-08:08:03,56) [usbhid_resumer]
(root,0,0,00:00:00/880-08:08:03,57) [deferwq]
(root,0,0,00:00:00/880-08:08:03,89) [kdmremove]
(root,0,0,00:00:00/880-08:08:03,90) [kstriped]
(root,0,0,00:00:00/880-08:07:58,233) [kdmflush]
(root,0,0,00:00:00/880-08:07:58,235) [kdmflush]
(root,0,0,00:00:14/880-08:07:45,252) [kjournald]
(root,10936,436,00:00:00/880-08:07:25,341) /sbin/udevd -d
(root,0,0,00:00:00/880-08:07:10,610) [kdmflush]
(root,0,0,00:00:00/880-08:07:10,613) [kdmflush]
(root,0,0,00:00:00/880-08:07:10,616) [kdmflush]
(root,0,0,00:00:00/880-08:07:10,621) [kdmflush]
(root,0,0,00:00:00/880-08:07:10,627) [kdmflush]
(root,10932,556,00:00:00/880-08:07:10,628) /sbin/udevd -d
(root,0,0,00:00:00/880-08:07:10,631) [kdmflush]
(root,10932,520,00:00:00/880-08:07:10,632) /sbin/udevd -d
(root,0,0,00:09:30/880-08:06:58,702) [flush-253:4]
(root,0,0,00:00:00/880-08:06:49,706) [kjournald]
(root,0,0,00:00:00/880-08:06:48,709) [xfs_mru_cache]
(root,0,0,00:05:18/880-08:06:48,710) [xfslogd/0]
(root,0,0,00:00:00/880-08:06:48,711) [xfslogd/1]
(root,0,0,00:06:53/880-08:06:48,712) [xfsdatad/0]
(root,0,0,00:00:00/880-08:06:48,713) [xfsdatad/1]
(root,0,0,00:00:00/880-08:06:48,714) [xfsconvertd/0]
(root,0,0,00:00:00/880-08:06:48,715) [xfsconvertd/1]
(root,0,0,00:00:07/880-08:06:48,716) [xfsalloc/0]
(root,0,0,00:00:20/880-08:06:48,717) [xfsalloc/1]
(root,0,0,00:00:07/880-08:06:48,718) [xfseofblocks/0]
(root,0,0,00:00:27/880-08:06:48,719) [xfseofblocks/1]
(root,0,0,00:00:00/880-08:06:48,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/880-08:06:48,721) [xfs-cil/dm-3]
(root,0,0,00:01:00/880-08:06:48,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/880-08:06:47,723) [xfsaild/dm-3]
(root,0,0,00:00:00/880-08:06:45,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/880-08:06:45,725) [xfs-cil/dm-2]
(root,0,0,00:01:02/880-08:06:45,726) [xfssyncd/dm-2]
(root,0,0,04:27:46/880-08:06:44,727) [xfsaild/dm-2]
(root,0,0,00:09:41/880-08:06:17,728) [kjournald]
(root,0,0,00:04:27/880-08:06:16,729) [xfsbufd/dm-5]
(root,0,0,00:02:52/880-08:06:16,730) [xfs-cil/dm-5]
(root,0,0,00:04:08/880-08:06:16,731) [xfssyncd/dm-5]
(root,0,0,06:12:58/880-08:06:16,732) [xfsaild/dm-5]
(root,0,0,00:00:02/880-08:06:14,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/880-08:06:14,734) [xfs-cil/dm-7]
(root,0,0,00:01:00/880-08:06:14,735) [xfssyncd/dm-7]
(root,0,0,04:29:20/880-08:06:14,736) [xfsaild/dm-7]
(root,0,0,00:00:00/880-08:06:12,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/880-08:06:12,738) [xfs-cil/dm-6]
(root,0,0,00:01:03/880-08:06:12,739) [xfssyncd/dm-6]
(root,0,0,04:29:27/880-08:06:12,740) [xfsaild/dm-6]
(root,0,0,00:28:26/880-08:05:53,816) [kauditd]
(root,93156,756,01:57:00/880-08:05:39,1154) auditd
(root,249864,5716,01:09:14/880-08:05:38,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:11/880-08:05:37,1195) rpcbind
(rpcuser,23404,1156,00:00:00/880-08:05:36,1215) rpc.statd
(dbus,21580,1040,00:00:04/880-08:05:34,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/880-08:05:32,1285) hald
(root,20400,956,00:00:00/880-08:05:32,1286) hald-runner
(root,452700,1544,00:20:59/880-08:05:26,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:27:16/880-08:05:21,1375) /usr/sbin/sshd
(root,21716,848,00:14:23/880-08:05:20,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:17:41/880-08:05:16,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:06/880-08:05:08,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:00:57/880-08:05:07,1555) qmgr -l -t fifo -u
(rabbitmq,10832,576,00:14:10/880-08:04:57,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/880-08:04:55,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/880-08:04:55,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/880-08:04:55,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424660,332328,5-11:32:02/880-08:04:55,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:31/880-08:04:35,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:45/880-08:04:35,1759) inet_gethost 4
(root,112532,964,00:00:00/880-08:04:34,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,517668,125700,00:49:30/880-08:04:29,1776) /usr/sbin/httpd
(root,116864,1220,00:07:37/880-08:04:28,1786) crond
(root,21104,484,00:00:00/880-08:04:28,1799) /usr/sbin/atd
(root,4064,544,00:00:00/880-08:04:28,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/880-08:04:28,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/880-08:04:28,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/880-08:04:28,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/880-08:04:28,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/880-08:04:28,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/880-08:04:28,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(apache,517668,115072,00:00:00/5-23:33:43,2975) /usr/sbin/httpd
(apache,519440,119828,00:00:00/5-23:33:43,2980) /usr/sbin/httpd
(apache,519440,119840,00:00:00/5-23:33:43,2985) /usr/sbin/httpd
(apache,519440,119844,00:00:00/5-23:33:43,2990) /usr/sbin/httpd
(apache,519440,119856,00:00:00/5-23:33:43,2995) /usr/sbin/httpd
(apache,519440,119868,00:00:00/5-23:33:42,3000) /usr/sbin/httpd
(apache,519440,119848,00:00:00/5-23:33:42,3005) /usr/sbin/httpd
(apache,519440,119552,00:00:00/5-23:33:42,3010) /usr/sbin/httpd
(apache,519440,119564,00:00:00/5-23:33:42,3016) /usr/sbin/httpd
(apache,519440,119836,00:00:00/4-02:11:42,6335) /usr/sbin/httpd
(root,0,0,00:00:00/10:11,9186) [flush-253:1]
(root,110268,1492,00:00:00/00:00,10475) /bin/bash /usr/bin/check_mk_agent
(root,13372,976,00:00:00/00:00,10493) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:00,10494) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,0,0,00:00:10/16-07:15:00,13806) [flush-253:5]
(root,108468,1060,00:00:00/77-16:17:13,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/77-16:17:13,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/77-16:17:13,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17064,06:31:32/77-16:17:13,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3364,00:00:00/01:35:29,31443) pickup -l -t fifo -u

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-11-05 06:45

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c793977033070

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:12:10/868-04:41:18,1) /sbin/init
(root,0,0,00:00:02/868-04:41:18,2) [kthreadd]
(root,0,0,00:07:58/868-04:41:18,3) [migration/0]
(root,0,0,00:05:03/868-04:41:18,4) [ksoftirqd/0]
(root,0,0,00:00:00/868-04:41:18,5) [stopper/0]
(root,0,0,00:02:14/868-04:41:18,6) [watchdog/0]
(root,0,0,00:10:37/868-04:41:18,7) [migration/1]
(root,0,0,00:00:00/868-04:41:18,8) [stopper/1]
(root,0,0,00:03:00/868-04:41:18,9) [ksoftirqd/1]
(root,0,0,00:02:06/868-04:41:18,10) [watchdog/1]
(root,0,0,01:31:42/868-04:41:18,11) [events/0]
(root,0,0,01:35:21/868-04:41:18,12) [events/1]
(root,0,0,00:00:00/868-04:41:18,13) [cgroup]
(root,0,0,00:00:00/868-04:41:18,14) [khelper]
(root,0,0,00:00:00/868-04:41:18,15) [netns]
(root,0,0,00:00:00/868-04:41:18,16) [async/mgr]
(root,0,0,00:00:00/868-04:41:18,17) [pm]
(root,0,0,00:00:00/868-04:41:18,18) [xenwatch]
(root,0,0,00:00:00/868-04:41:18,19) [xenbus]
(root,0,0,00:04:53/868-04:41:18,20) [sync_supers]
(root,0,0,00:05:52/868-04:41:18,21) [bdi-default]
(root,0,0,00:00:00/868-04:41:18,22) [kintegrityd/0]
(root,0,0,00:00:00/868-04:41:18,23) [kintegrityd/1]
(root,0,0,00:04:47/868-04:41:18,24) [kblockd/0]
(root,0,0,00:00:57/868-04:41:18,25) [kblockd/1]
(root,0,0,00:00:00/868-04:41:18,26) [ata_aux]
(root,0,0,00:00:00/868-04:41:18,27) [ata_sff/0]
(root,0,0,00:00:00/868-04:41:18,28) [ata_sff/1]
(root,0,0,00:00:00/868-04:41:18,29) [ksuspend_usbd]
(root,0,0,00:00:00/868-04:41:18,30) [khubd]
(root,0,0,00:00:00/868-04:41:18,31) [kseriod]
(root,0,0,00:00:00/868-04:41:18,32) [md/0]
(root,0,0,00:00:00/868-04:41:18,33) [md/1]
(root,0,0,00:00:00/868-04:41:18,34) [md_misc/0]
(root,0,0,00:00:00/868-04:41:18,35) [md_misc/1]
(root,0,0,00:00:00/868-04:41:18,36) [linkwatch]
(root,0,0,00:00:28/868-04:41:18,37) [khungtaskd]
(root,0,0,00:00:00/868-04:41:18,38) [kswapd0]
(root,0,0,00:00:00/868-04:41:18,39) [ksmd]
(root,0,0,00:00:00/868-04:41:18,40) [aio/0]
(root,0,0,00:00:00/868-04:41:18,41) [aio/1]
(root,0,0,00:00:00/868-04:41:18,42) [crypto/0]
(root,0,0,00:00:00/868-04:41:18,43) [crypto/1]
(root,0,0,00:00:00/868-04:41:18,51) [kthrotld/0]
(root,0,0,00:00:00/868-04:41:18,52) [kthrotld/1]
(root,0,0,00:00:00/868-04:41:18,54) [khvcd]
(root,0,0,00:00:00/868-04:41:18,55) [kpsmoused]
(root,0,0,00:00:00/868-04:41:18,56) [usbhid_resumer]
(root,0,0,00:00:00/868-04:41:18,57) [deferwq]
(root,0,0,00:00:00/868-04:41:18,89) [kdmremove]
(root,0,0,00:00:00/868-04:41:18,90) [kstriped]
(root,0,0,00:00:00/868-04:41:13,233) [kdmflush]
(root,0,0,00:00:00/868-04:41:13,235) [kdmflush]
(root,0,0,00:00:14/868-04:41:00,252) [kjournald]
(root,13372,972,00:00:00/00:01,304) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8388,712,00:00:00/00:01,305) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /
(root,10936,436,00:00:00/868-04:40:40,341) /sbin/udevd -d
(root,0,0,00:00:00/868-04:40:25,610) [kdmflush]
(root,0,0,00:00:00/868-04:40:25,613) [kdmflush]
(root,0,0,00:00:00/868-04:40:25,616) [kdmflush]
(root,0,0,00:00:00/868-04:40:25,621) [kdmflush]
(root,0,0,00:00:00/868-04:40:25,627) [kdmflush]
(root,10932,556,00:00:00/868-04:40:25,628) /sbin/udevd -d
(root,0,0,00:00:00/868-04:40:25,631) [kdmflush]
(root,10932,520,00:00:00/868-04:40:25,632) /sbin/udevd -d
(root,0,0,00:09:21/868-04:40:13,702) [flush-253:4]
(root,0,0,00:00:00/868-04:40:04,706) [kjournald]
(root,0,0,00:00:00/868-04:40:03,709) [xfs_mru_cache]
(root,0,0,00:05:14/868-04:40:03,710) [xfslogd/0]
(root,0,0,00:00:00/868-04:40:03,711) [xfslogd/1]
(root,0,0,00:06:48/868-04:40:03,712) [xfsdatad/0]
(root,0,0,00:00:00/868-04:40:03,713) [xfsdatad/1]
(root,0,0,00:00:00/868-04:40:03,714) [xfsconvertd/0]
(root,0,0,00:00:00/868-04:40:03,715) [xfsconvertd/1]
(root,0,0,00:00:07/868-04:40:03,716) [xfsalloc/0]
(root,0,0,00:00:19/868-04:40:03,717) [xfsalloc/1]
(root,0,0,00:00:07/868-04:40:03,718) [xfseofblocks/0]
(root,0,0,00:00:27/868-04:40:03,719) [xfseofblocks/1]
(root,0,0,00:00:00/868-04:40:03,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/868-04:40:03,721) [xfs-cil/dm-3]
(root,0,0,00:00:59/868-04:40:03,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/868-04:40:02,723) [xfsaild/dm-3]
(root,0,0,00:00:00/868-04:40:00,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/868-04:40:00,725) [xfs-cil/dm-2]
(root,0,0,00:01:01/868-04:40:00,726) [xfssyncd/dm-2]
(root,0,0,04:23:36/868-04:39:59,727) [xfsaild/dm-2]
(root,0,0,00:09:32/868-04:39:32,728) [kjournald]
(root,0,0,00:04:24/868-04:39:31,729) [xfsbufd/dm-5]
(root,0,0,00:02:50/868-04:39:31,730) [xfs-cil/dm-5]
(root,0,0,00:04:04/868-04:39:31,731) [xfssyncd/dm-5]
(root,0,0,06:07:42/868-04:39:31,732) [xfsaild/dm-5]
(root,0,0,00:00:02/868-04:39:29,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/868-04:39:29,734) [xfs-cil/dm-7]
(root,0,0,00:01:00/868-04:39:29,735) [xfssyncd/dm-7]
(root,0,0,04:25:09/868-04:39:29,736) [xfsaild/dm-7]
(root,0,0,00:00:00/868-04:39:27,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/868-04:39:27,738) [xfs-cil/dm-6]
(root,0,0,00:01:02/868-04:39:27,739) [xfssyncd/dm-6]
(root,0,0,04:25:14/868-04:39:27,740) [xfsaild/dm-6]
(root,0,0,00:28:10/868-04:39:08,816) [kauditd]
(root,93156,756,01:55:57/868-04:38:54,1154) auditd
(root,249864,5716,01:08:37/868-04:38:53,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:09/868-04:38:52,1195) rpcbind
(rpcuser,23404,1156,00:00:00/868-04:38:51,1215) rpc.statd
(dbus,21580,1040,00:00:04/868-04:38:49,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/868-04:38:47,1285) hald
(root,20400,956,00:00:00/868-04:38:47,1286) hald-runner
(root,452700,1544,00:20:41/868-04:38:41,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:25:59/868-04:38:36,1375) /usr/sbin/sshd
(root,21716,848,00:14:11/868-04:38:35,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:17:26/868-04:38:31,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:06:01/868-04:38:23,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:00:56/868-04:38:22,1555) qmgr -l -t fifo -u
(rabbitmq,10832,576,00:13:58/868-04:38:12,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/868-04:38:10,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1108,00:00:00/868-04:38:10,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1492,00:00:00/868-04:38:10,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1423364,332464,5-09:43:24/868-04:38:10,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:30/868-04:37:50,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:42/868-04:37:50,1759) inet_gethost 4
(root,112532,964,00:00:00/868-04:37:49,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,516876,124852,00:48:44/868-04:37:44,1776) /usr/sbin/httpd
(root,116864,1220,00:07:30/868-04:37:43,1786) crond
(root,21104,484,00:00:00/868-04:37:43,1799) /usr/sbin/atd
(root,4064,544,00:00:00/868-04:37:43,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/868-04:37:43,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/868-04:37:43,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/868-04:37:43,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/868-04:37:43,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/868-04:37:43,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/868-04:37:43,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:02/4-03:48:15,13806) [flush-253:5]
(apache,516876,114224,00:00:00/20:09:00,14604) /usr/sbin/httpd
(apache,518584,118516,00:00:00/20:09:00,14613) /usr/sbin/httpd
(apache,518584,118508,00:00:00/20:09:00,14619) /usr/sbin/httpd
(apache,518584,118520,00:00:00/20:09:00,14624) /usr/sbin/httpd
(apache,518592,118496,00:00:00/20:09:00,14627) /usr/sbin/httpd
(apache,518592,118544,00:00:00/20:09:00,14632) /usr/sbin/httpd
(apache,518592,118488,00:00:00/20:09:00,14637) /usr/sbin/httpd
(apache,518592,118496,00:00:00/20:09:00,14642) /usr/sbin/httpd
(apache,518592,118480,00:00:00/20:09:00,14647) /usr/sbin/httpd
(root,108468,1060,00:00:00/65-12:50:28,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/65-12:50:28,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/65-12:50:28,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1380020,17128,05:28:22/65-12:50:28,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3372,00:00:00/23:35,29926) pickup -l -t fifo -u
(root,66224,3100,00:00:00/01:10,32500) sshd: [accepted] 
(root,66224,3104,00:00:00/00:17,32616) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,32754) /bin/bash /usr/bin/check_mk_agent

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-10-24 03:18

Severity: high
Fingerprint: 03cb82e6f6a6b45342c4bbcb76c1b6ce66f06e791b1eae92ed7c7939514bf1ce

Found public CheckMk agent:
Version: 1.5.0p7
AgentOS: linux
Hostname: rabbit2.vidvita.com
AgentDirectory: /etc/check_mk
DataDirectory: /var/lib/check_mk_agent
SpoolDirectory: /var/lib/check_mk_agent/spool
PluginsDirectory: /usr/lib/check_mk_agent/plugins
LocalDirectory: /usr/lib/check_mk_agent/local
OnlyFrom: 

Found process list through CheckMk:
(root,19356,1444,00:11:58/842-15:17:41,1) /sbin/init
(root,0,0,00:00:02/842-15:17:41,2) [kthreadd]
(root,0,0,00:07:43/842-15:17:41,3) [migration/0]
(root,0,0,00:04:46/842-15:17:41,4) [ksoftirqd/0]
(root,0,0,00:00:00/842-15:17:41,5) [stopper/0]
(root,0,0,00:02:10/842-15:17:41,6) [watchdog/0]
(root,0,0,00:10:18/842-15:17:41,7) [migration/1]
(root,0,0,00:00:00/842-15:17:41,8) [stopper/1]
(root,0,0,00:02:52/842-15:17:41,9) [ksoftirqd/1]
(root,0,0,00:02:03/842-15:17:41,10) [watchdog/1]
(root,0,0,01:28:54/842-15:17:41,11) [events/0]
(root,0,0,01:32:24/842-15:17:41,12) [events/1]
(root,0,0,00:00:00/842-15:17:41,13) [cgroup]
(root,0,0,00:00:00/842-15:17:41,14) [khelper]
(root,0,0,00:00:00/842-15:17:41,15) [netns]
(root,0,0,00:00:00/842-15:17:41,16) [async/mgr]
(root,0,0,00:00:00/842-15:17:41,17) [pm]
(root,0,0,00:00:00/842-15:17:41,18) [xenwatch]
(root,0,0,00:00:00/842-15:17:41,19) [xenbus]
(root,0,0,00:04:44/842-15:17:41,20) [sync_supers]
(root,0,0,00:05:42/842-15:17:41,21) [bdi-default]
(root,0,0,00:00:00/842-15:17:41,22) [kintegrityd/0]
(root,0,0,00:00:00/842-15:17:41,23) [kintegrityd/1]
(root,0,0,00:04:39/842-15:17:41,24) [kblockd/0]
(root,0,0,00:00:56/842-15:17:41,25) [kblockd/1]
(root,0,0,00:00:00/842-15:17:41,26) [ata_aux]
(root,0,0,00:00:00/842-15:17:41,27) [ata_sff/0]
(root,0,0,00:00:00/842-15:17:41,28) [ata_sff/1]
(root,0,0,00:00:00/842-15:17:41,29) [ksuspend_usbd]
(root,0,0,00:00:00/842-15:17:41,30) [khubd]
(root,0,0,00:00:00/842-15:17:41,31) [kseriod]
(root,0,0,00:00:00/842-15:17:41,32) [md/0]
(root,0,0,00:00:00/842-15:17:41,33) [md/1]
(root,0,0,00:00:00/842-15:17:41,34) [md_misc/0]
(root,0,0,00:00:00/842-15:17:41,35) [md_misc/1]
(root,0,0,00:00:00/842-15:17:41,36) [linkwatch]
(root,0,0,00:00:27/842-15:17:41,37) [khungtaskd]
(root,0,0,00:00:00/842-15:17:41,38) [kswapd0]
(root,0,0,00:00:00/842-15:17:41,39) [ksmd]
(root,0,0,00:00:00/842-15:17:41,40) [aio/0]
(root,0,0,00:00:00/842-15:17:41,41) [aio/1]
(root,0,0,00:00:00/842-15:17:41,42) [crypto/0]
(root,0,0,00:00:00/842-15:17:41,43) [crypto/1]
(root,0,0,00:00:00/842-15:17:41,51) [kthrotld/0]
(root,0,0,00:00:00/842-15:17:41,52) [kthrotld/1]
(root,0,0,00:00:00/842-15:17:41,54) [khvcd]
(root,0,0,00:00:00/842-15:17:41,55) [kpsmoused]
(root,0,0,00:00:00/842-15:17:41,56) [usbhid_resumer]
(root,0,0,00:00:00/842-15:17:41,57) [deferwq]
(root,0,0,00:00:00/842-15:17:41,89) [kdmremove]
(root,0,0,00:00:00/842-15:17:41,90) [kstriped]
(root,0,0,00:00:00/842-15:17:36,233) [kdmflush]
(root,0,0,00:00:00/842-15:17:36,235) [kdmflush]
(root,0,0,00:00:13/842-15:17:23,252) [kjournald]
(root,10936,436,00:00:00/842-15:17:03,341) /sbin/udevd -d
(root,0,0,00:00:00/842-15:16:48,610) [kdmflush]
(root,0,0,00:00:00/842-15:16:48,613) [kdmflush]
(root,0,0,00:00:00/842-15:16:48,616) [kdmflush]
(root,0,0,00:00:00/842-15:16:48,621) [kdmflush]
(root,0,0,00:00:00/842-15:16:48,627) [kdmflush]
(root,10932,556,00:00:00/842-15:16:48,628) /sbin/udevd -d
(root,0,0,00:00:00/842-15:16:48,631) [kdmflush]
(root,10932,520,00:00:00/842-15:16:48,632) /sbin/udevd -d
(root,0,0,00:09:03/842-15:16:36,702) [flush-253:4]
(root,0,0,00:00:00/842-15:16:27,706) [kjournald]
(root,0,0,00:00:00/842-15:16:26,709) [xfs_mru_cache]
(root,0,0,00:05:06/842-15:16:26,710) [xfslogd/0]
(root,0,0,00:00:00/842-15:16:26,711) [xfslogd/1]
(root,0,0,00:06:39/842-15:16:26,712) [xfsdatad/0]
(root,0,0,00:00:00/842-15:16:26,713) [xfsdatad/1]
(root,0,0,00:00:00/842-15:16:26,714) [xfsconvertd/0]
(root,0,0,00:00:00/842-15:16:26,715) [xfsconvertd/1]
(root,0,0,00:00:07/842-15:16:26,716) [xfsalloc/0]
(root,0,0,00:00:19/842-15:16:26,717) [xfsalloc/1]
(root,0,0,00:00:07/842-15:16:26,718) [xfseofblocks/0]
(root,0,0,00:00:26/842-15:16:26,719) [xfseofblocks/1]
(root,0,0,00:00:00/842-15:16:26,720) [xfsbufd/dm-3]
(root,0,0,00:00:00/842-15:16:26,721) [xfs-cil/dm-3]
(root,0,0,00:00:57/842-15:16:26,722) [xfssyncd/dm-3]
(root,0,0,00:00:00/842-15:16:25,723) [xfsaild/dm-3]
(root,0,0,00:00:00/842-15:16:23,724) [xfsbufd/dm-2]
(root,0,0,00:00:00/842-15:16:23,725) [xfs-cil/dm-2]
(root,0,0,00:00:59/842-15:16:23,726) [xfssyncd/dm-2]
(root,0,0,04:14:46/842-15:16:22,727) [xfsaild/dm-2]
(root,0,0,00:09:15/842-15:15:55,728) [kjournald]
(root,0,0,00:04:16/842-15:15:54,729) [xfsbufd/dm-5]
(root,0,0,00:02:46/842-15:15:54,730) [xfs-cil/dm-5]
(root,0,0,00:03:56/842-15:15:54,731) [xfssyncd/dm-5]
(root,0,0,05:56:38/842-15:15:54,732) [xfsaild/dm-5]
(root,0,0,00:00:02/842-15:15:52,733) [xfsbufd/dm-7]
(root,0,0,00:00:01/842-15:15:52,734) [xfs-cil/dm-7]
(root,0,0,00:00:58/842-15:15:52,735) [xfssyncd/dm-7]
(root,0,0,04:16:16/842-15:15:52,736) [xfsaild/dm-7]
(root,0,0,00:00:00/842-15:15:50,737) [xfsbufd/dm-6]
(root,0,0,00:00:00/842-15:15:50,738) [xfs-cil/dm-6]
(root,0,0,00:01:00/842-15:15:50,739) [xfssyncd/dm-6]
(root,0,0,04:16:24/842-15:15:50,740) [xfsaild/dm-6]
(root,0,0,00:27:38/842-15:15:31,816) [kauditd]
(root,93156,756,01:53:46/842-15:15:17,1154) auditd
(root,249864,5716,01:07:17/842-15:15:16,1175) /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
(rpc,19044,984,00:05:02/842-15:15:15,1195) rpcbind
(rpcuser,23404,1156,00:00:00/842-15:15:14,1215) rpc.statd
(dbus,21580,1040,00:00:04/842-15:15:12,1248) dbus-daemon --system
(haldaemon,38764,2176,00:00:01/842-15:15:10,1285) hald
(root,20400,956,00:00:00/842-15:15:10,1286) hald-runner
(root,452700,1544,00:20:04/842-15:15:04,1347) automount --pid-file /var/run/autofs.pid
(root,66216,620,02:23:22/842-15:14:59,1375) /usr/sbin/sshd
(root,21716,848,00:13:46/842-15:14:58,1384) xinetd -stayalive -pidfile /var/run/xinetd.pid
(ntp,30732,1764,00:16:55/842-15:14:54,1410) ntpd -u ntp:ntp -p /var/run/ntpd.pid -g
(root,80856,2568,00:05:50/842-15:14:46,1548) /usr/libexec/postfix/master
(postfix,81108,2604,00:00:54/842-15:14:45,1555) qmgr -l -t fifo -u
(rabbitmq,10832,572,00:13:33/842-15:14:35,1624) /usr/lib64/erlang/erts-5.8.5/bin/epmd -daemon
(root,108472,588,00:00:00/842-15:14:33,1634) /bin/sh /etc/rc3.d/S80rabbitmq-server start
(root,108200,1188,00:00:00/842-15:14:33,1646) /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/rabbitmq-server
(root,163384,1916,00:00:00/842-15:14:33,1648) su rabbitmq -s /bin/sh -c /usr/lib/rabbitmq/bin/rabbitmq-server 
(rabbitmq,1424988,332580,5-05:54:00/842-15:14:33,1668) /usr/lib64/erlang/erts-5.8.5/bin/beam.smp -W w -K true -A30 -P 1048576 -- -root /usr/lib64/erlang -progname erl -- -home /var/lib/rabbitmq -- -pa /usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../ebin -noshell -noinput -s rabbit boot -sname rabbit@rabbit2 -boot start_sasl -kernel inet_default_connect_options [{nodelay,true}] -sasl errlog_type error -sasl sasl_error_logger false -rabbit error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2.log"} -rabbit sasl_error_logger {file,"/var/log/rabbitmq/rabbit@rabbit2-sasl.log"} -rabbit enabled_plugins_file "/etc/rabbitmq/enabled_plugins" -rabbit plugins_dir "/usr/lib/rabbitmq/lib/rabbitmq_server-3.5.0/sbin/../plugins" -rabbit plugins_expand_dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2-plugins-expand" -os_mon start_cpu_sup false -os_mon start_disksup false -os_mon start_memsup false -mnesia dir "/var/lib/rabbitmq/mnesia/rabbit@rabbit2" -kernel inet_dist_listen_min 25672 -kernel inet_dist_listen_max 25672
(rabbitmq,10792,504,00:01:27/842-15:14:13,1758) inet_gethost 4
(rabbitmq,17120,864,00:02:37/842-15:14:13,1759) inet_gethost 4
(root,112532,964,00:00:00/842-15:14:12,1767) abrt-dump-oops -d /var/spool/abrt -rwx /var/log/messages
(root,513440,121468,00:47:09/842-15:14:07,1776) /usr/sbin/httpd
(root,116864,1220,00:07:17/842-15:14:06,1786) crond
(root,21104,484,00:00:00/842-15:14:06,1799) /usr/sbin/atd
(root,4064,544,00:00:00/842-15:14:06,1819) /sbin/mingetty /dev/tty1
(root,4064,544,00:00:00/842-15:14:06,1821) /sbin/mingetty /dev/tty2
(root,4064,540,00:00:00/842-15:14:06,1823) /sbin/mingetty /dev/tty3
(root,4064,540,00:00:00/842-15:14:06,1825) /sbin/mingetty /dev/tty4
(root,4064,540,00:00:00/842-15:14:06,1827) /sbin/mingetty /dev/tty5
(root,4064,540,00:00:00/842-15:14:06,1829) /sbin/mingetty /dev/tty6
(root,4080,608,00:00:00/842-15:14:06,1830) /sbin/agetty /dev/hvc0 38400 vt100-nav
(root,0,0,00:00:17/26-06:44:39,8028) [flush-253:5]
(apache,513440,110840,00:00:00/3-06:19:24,16336) /usr/sbin/httpd
(apache,515208,115536,00:00:00/3-06:19:24,16337) /usr/sbin/httpd
(apache,515200,115188,00:00:00/3-06:19:24,16338) /usr/sbin/httpd
(apache,515196,115504,00:00:00/3-06:19:24,16339) /usr/sbin/httpd
(apache,515200,115200,00:00:00/3-06:19:24,16341) /usr/sbin/httpd
(apache,515208,115488,00:00:00/3-06:19:24,16342) /usr/sbin/httpd
(apache,515200,115236,00:00:00/3-06:19:24,16346) /usr/sbin/httpd
(apache,515208,115216,00:00:00/3-06:19:24,16353) /usr/sbin/httpd
(apache,515208,115248,00:00:00/3-06:19:24,16354) /usr/sbin/httpd
(root,108468,1060,00:00:00/39-23:26:51,20813) /bin/sh /etc/init.d/zabbix-agent2 start
(root,130716,1384,00:00:00/39-23:26:51,20816) runuser -s /bin/bash zabbix -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,106096,1164,00:00:00/39-23:26:51,20817) bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(zabbix,1379764,17316,03:15:09/39-23:26:51,20818) /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf
(postfix,80944,3368,00:00:00/51:15,23802) pickup -l -t fifo -u
(apache,515208,115160,00:00:00/2-15:20:01,26914) /usr/sbin/httpd
(root,66224,3100,00:00:00/01:53,29551) sshd: [accepted] 
(root,66224,3104,00:00:00/01:34,29556) sshd: [accepted] 
(root,66224,3104,00:00:00/00:52,29668) sshd: [accepted] 
(root,66224,3100,00:00:00/00:02,29788) sshd: [accepted] 
(root,110268,1488,00:00:00/00:01,29925) /bin/bash /usr/bin/check_mk_agent
(root,13368,972,00:00:00/00:01,29943) ps ax -o user:32,vsz,rss,cputime,etime,pid,command --columns 10000
(root,8392,796,00:00:00/00:01,29944) sed -e 1d -e s/ *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) *\([^ ]*\) */(\1,\2,\3,\4\/\5,\6) /

Found network interfaces through CheckMk:
[start_iplink]
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:87:07:7c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:74:38:eb brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:16:3e:7e:79:8d brd ff:ff:ff:ff:ff:ff
[end_iplink]

Found on 2022-09-28 13:54

Create report

Domain summary

No record