|
Dec 1, 23:02:03
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:02:03
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=50000
|
Info
|
|
|
Dec 1, 23:02:02
3 weeks ago
|
default-host
|
Ssh Login
|
64.176.212.158
|
66.135.25.80
|
root
|
No details
|
Warning
|
|
|
Dec 1, 23:02:02
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:02:02
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=10000
|
Info
|
|
|
Dec 1, 23:02:02
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILESIZE=10000
|
Info
|
|
|
Dec 1, 23:02:02
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTCONTROL=
|
Info
|
|
|
Dec 1, 23:01:41
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo 'Recent audit events:'
|
Info
|
|
|
Dec 1, 23:01:41
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
ausearch -ts recent 2> /dev/null
|
Info
|
|
|
Dec 1, 23:01:41
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
tail -20
|
Info
|
|
|
Dec 1, 23:01:40
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo 'Audit rules:'
|
Info
|
|
|
Dec 1, 23:01:40
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
auditctl -l 2> /dev/null
|
Info
|
|
|
Dec 1, 23:01:40
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
head -20
|
Info
|
|
|
Dec 1, 23:01:40
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo
|
Info
|
|
|
Dec 1, 23:01:39
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILE="${HOME}/.bash_history_$(date +%Y%...
|
Critical
|
|
|
Dec 1, 23:01:39
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo '=== KAUDITD AND AUDITD ANALYSIS ==='
|
Info
|
|
|
Dec 1, 23:01:39
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo
|
Info
|
|
|
Dec 1, 23:01:38
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=50000
|
Info
|
|
|
Dec 1, 23:01:38
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILESIZE=50000
|
Info
|
|
|
Dec 1, 23:01:38
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTCONTROL=""
|
Info
|
|
|
Dec 1, 23:01:38
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
shopt -s histappend
|
Critical
|
|
|
Dec 1, 23:01:37
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILESIZE=10000
|
Info
|
|
|
Dec 1, 23:01:37
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTCONTROL=
|
Info
|
|
|
Dec 1, 23:01:37
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
shopt -s histappend
|
Critical
|
|
|
Dec 1, 23:01:37
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:01:36
3 weeks ago
|
default-host
|
Ssh Login
|
64.176.212.158
|
66.135.25.80
|
root
|
No details
|
Warning
|
|
|
Dec 1, 23:01:36
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:01:36
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=10000
|
Info
|
|
|
Dec 1, 23:01:34
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo '=== HOST-LEVEL TOP (not container) ==='
|
Info
|
|
|
Dec 1, 23:01:34
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
top -bn1 -o %CPU
|
Info
|
|
|
Dec 1, 23:01:34
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
head -30
|
Info
|
|
|
Dec 1, 23:01:33
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILESIZE=50000
|
Info
|
|
|
Dec 1, 23:01:33
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTCONTROL=""
|
Info
|
|
|
Dec 1, 23:01:33
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
shopt -s histappend
|
Critical
|
|
|
Dec 1, 23:01:33
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILE="${HOME}/.bash_history_$(date +%Y%...
|
Critical
|
|
|
Dec 1, 23:01:32
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:01:32
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=50000
|
Info
|
|
|
Dec 1, 23:01:31
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILESIZE=10000
|
Info
|
|
|
Dec 1, 23:01:31
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTCONTROL=
|
Info
|
|
|
Dec 1, 23:01:31
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
shopt -s histappend
|
Critical
|
|
|
Dec 1, 23:01:30
3 weeks ago
|
default-host
|
Ssh Login
|
64.176.212.158
|
66.135.25.80
|
root
|
No details
|
Warning
|
|
|
Dec 1, 23:01:30
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
|
Critical
|
|
|
Dec 1, 23:01:30
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTSIZE=10000
|
Info
|
|
|
Dec 1, 23:01:20
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
head -25
|
Info
|
|
|
Dec 1, 23:01:19
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo '=== CHECKING FOR HIDDEN PROCESSES ==='
|
Critical
|
|
|
Dec 1, 23:01:19
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo
|
Info
|
|
|
Dec 1, 23:01:19
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
echo 'All processes with high CPU (last 60 sec):'
|
Info
|
|
|
Dec 1, 23:01:19
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
docker exec azuracast top -b -n1
|
Info
|
|
|
Dec 1, 23:01:18
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
shopt -s histappend
|
Critical
|
|
|
Dec 1, 23:01:18
3 weeks ago
|
default-host
|
Command
|
64.176.212.158
|
66.135.25.80
|
root
|
export HISTFILE="${HOME}/.bash_history_$(date +%Y%...
|
Critical
|
|