003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_socket"
[404310.996805] type=1327 audit(1570434873.571:3588540): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404310.996897] type=1300 audit(1570434873.571:3588541): arch=c000003e syscall=42 success=no exit=-115 a0=2cb a1=7f17ee78c140 a2=10 a3=5d9aef39 items=0 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_connect"
[404310.996901] type=1306 audit(1570434873.571:3588541): saddr=020000500A0297090000000000000000
[404316.005740] audit_printk_skb: 318 callbacks suppressed
[404316.005770] type=1300 audit(1570434878.580:3588575): arch=c000003e syscall=2 success=yes exit=735 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404316.005784] type=1302 audit(1570434878.580:3588575): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404316.005790] type=1327 audit(1570434878.580:3588575): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404316.190095] type=1300 audit(1570434878.764:3588576): arch=c000003e syscall=2 success=yes exit=735 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404316.190105] type=1302 audit(1570434878.764:3588576): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404316.190109] type=1327 audit(1570434878.764:3588576): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404316.218414] type=1300 audit(1570434878.792:3588577): arch=c000003e syscall=2 success=yes exit=735 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404316.218428] type=1302 audit(1570434878.792:3588577): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404316.218434] type=1327 audit(1570434878.792:3588577): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404316.223964] type=1300 audit(1570434878.798:3588578): arch=c000003e syscall=2 success=yes exit=735 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404321.095600] audit_printk_skb: 771 callbacks suppressed
[404321.095604] type=1300 audit(1570434883.669:3588653): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=9016 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404321.095608] type=1306 audit(1570434883.669:3588653): saddr=0A00BCBB0000000000000000000000000000FFFF0A02011900000000
[404321.095610] type=1327 audit(1570434883.669:3588653): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404321.318569] type=1300 audit(1570434883.892:3588654): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404321.318591] type=1302 audit(1570434883.892:3588654): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404321.318596] type=1327 audit(1570434883.892:3588654): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404321.514823] type=1300 audit(1570434884.089:3588655): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=21249 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404321.514831] type=1306 audit(1570434884.089:3588655): saddr=0A00BCE40000000000000000000000000000FFFF0A02011900000000
[404321.514849] type=1327 audit(1570434884.089:3588655): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404321.518620] type=1300 audit(1570434884.092:3588656): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404326.266969] audit_printk_skb: 372 callbacks suppressed
[404326.266974] type=1300 audit(1570434888.841:3588696): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404326.266982] type=1302 audit(1570434888.841:3588696): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404326.266986] type=1327 audit(1570434888.841:3588696): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404326.470749] type=1300 audit(1570434889.044:3588697): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404326.470782] type=1302 audit(1570434889.044:3588697): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404326.470787] type=1327 audit(1570434889.044:3588697): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404326.606451] type=1300 audit(1570434889.180:3588698): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404326.606461] type=1302 audit(1570434889.180:3588698): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404326.606486] type=1327 audit(1570434889.180:3588698): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404326.623994] type=1300 audit(1570434889.198:3588699): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404331.608889] audit_printk_skb: 687 callbacks suppressed
[404331.608893] type=1300 audit(1570434894.182:3588763): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404331.608897] type=1306 audit(1570434894.182:3588763): saddr=0200D0F60A02FD420000000000000000
[404331.608900] type=1327 audit(1570434894.182:3588763): proctitle=2F7573722F7362696E2F7A61626269785F6167656E74643A206C697374656E6572202333205B77616974696E6720666F7220636F6E6E656374696F6E5D
[404331.933588] type=1300 audit(1570434894.507:3588764): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=4872 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404331.933594] type=1306 audit(1570434894.507:3588764): saddr=0A00BF8D0000000000000000000000000000FFFF0A02011900000000
[404331.933597] type=1327 audit(1570434894.507:3588764): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404332.509276] type=1300 audit(1570434895.083:3588765): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1216 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404332.509282] type=1306 audit(1570434895.083:3588765): saddr=0A00BFB60000000000000000000000000000FFFF0A02011900000000
[404332.509285] type=1327 audit(1570434895.083:3588765): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404332.769789] type=1300 audit(1570434895.343:3588766): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404336.761514] audit_printk_skb: 453 callbacks suppressed
[404336.761518] type=1300 audit(1570434899.335:3588817): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=4872 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404336.761522] type=1306 audit(1570434899.335:3588817): saddr=0A00EDDC0000000000000000000000000000FFFF0A02FD4200000000
[404336.761525] type=1327 audit(1570434899.335:3588817): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404336.867997] type=1300 audit(1570434899.442:3588818): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1216 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404336.868003] type=1306 audit(1570434899.442:3588818): saddr=0A00C1270000000000000000000000000000FFFF0A02011900000000
[404336.868005] type=1327 audit(1570434899.442:3588818): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404336.933743] type=1300 audit(1570434899.507:3588819): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=30576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404336.933751] type=1309 audit(1570434899.507:3588819): argc=3 a0="sh" a1="-c" a2="users"
[404336.933758] type=1302 audit(1570434899.507:3588819): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404336.933763] type=1302 audit(1570434899.507:3588819): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404341.783198] audit_printk_skb: 1011 callbacks suppressed
[404341.783202] type=1300 audit(1570434904.356:3588925): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=21249 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404341.783206] type=1306 audit(1570434904.356:3588925): saddr=0A00C2D80000000000000000000000000000FFFF0A02011900000000
[404341.783209] type=1327 audit(1570434904.356:3588925): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404342.001215] type=1300 audit(1570434903.558:3588926): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404342.001221] type=1306 audit(1570434903.558:3588926): saddr=0200D6C40A02FD420000000000000000
[404342.001224] type=1327 audit(1570434903.558:3588926): proctitle=2F7573722F7362696E2F7A61626269785F6167656E74643A206C697374656E6572202333205B77616974696E6720666F7220636F6E6E656374696F6E5D
[404342.305217] type=1300 audit(1570434904.878:3588927): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=9148 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404342.305223] type=1306 audit(1570434904.878:3588927): saddr=0A00C3050000000000000000000000000000FFFF0A02011900000000
[404342.305226] type=1327 audit(1570434904.878:3588927): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404342.697195] type=1300 audit(1570434905.270:3588928): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=19272 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404346.874338] audit_printk_skb: 315 callbacks suppressed
[404346.874342] type=1300 audit(1570434909.447:3588962): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404346.874350] type=1302 audit(1570434909.447:3588962): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404346.874353] type=1327 audit(1570434909.447:3588962): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404346.875481] type=1300 audit(1570434909.448:3588963): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404346.875489] type=1322 audit(1570434909.448:3588963): pid=6121 cap_pi=0000000400000002 cap_pp=0000000400002c0f cap_pe=0000000400000002 cap_pa=0000000000000000
[404346.875491] type=1327 audit(1570434909.448:3588963): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[404346.875555] type=1300 audit(1570434909.448:3588964): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404346.875560] type=1322 audit(1570434909.448:3588964): pid=6121 cap_pi=0000000400000003 cap_pp=0000000400002c0f cap_pe=0000000400000003 cap_pa=0000000000000000
[404346.875562] type=1327 audit(1570434909.448:3588964): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[404346.875585] type=1300 audit(1570434909.448:3588965): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404352.023539] audit_printk_skb: 954 callbacks suppressed
[404352.023543] type=1300 audit(1570434914.595:3589061): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=30688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404352.023549] type=1309 audit(1570434914.595:3589061): argc=3 a0="sh" a1="-c" a2="users"
[404352.023555] type=1302 audit(1570434914.595:3589061): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404352.023560] type=1302 audit(1570434914.595:3589061): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404352.023564] type=1327 audit(1570434914.595:3589061): proctitle=7368002D63007573657273
[404352.026970] type=1300 audit(1570434914.599:3589062): arch=c000003e syscall=59 success=yes exit=0 a0=1fada30 a1=1fadd10 a2=1facc30 a3=7ffd436c41a0 items=2 ppid=12924 pid=30688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="users" exe="/usr/bin/users" key="pt_siem_execve_root"
[404352.026975] type=1309 audit(1570434914.599:3589062): argc=1 a0="users"
[404352.026981] type=1302 audit(1570434914.599:3589062): item=0 name="/usr/bin/users" inode=2099045 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404352.026986] type=1302 audit(1570434914.599:3589062): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404352.026988] type=1327 audit(1570434914.599:3589062): proctitle=7368002D63007573657273
[404357.314162] audit_printk_skb: 426 callbacks suppressed
[404357.314167] type=1300 audit(1570434919.887:3589110): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=2522 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404357.314171] type=1306 audit(1570434919.887:3589110): saddr=0A00C7F30000000000000000000000000000FFFF0A02011900000000
[404357.314173] type=1327 audit(1570434919.887:3589110): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404357.559345] type=1300 audit(1570434920.133:3589111): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404357.559352] type=1306 audit(1570434920.133:3589111): saddr=0200DE580A02FD420000000000000000
[404357.559355] type=1327 audit(1570434920.133:3589111): proctitle=2F7573722F7362696E2F7A61626269785F6167656E74643A206C697374656E6572202333205B77616974696E6720666F7220636F6E6E656374696F6E5D
[404357.594329] type=1300 audit(1570434920.168:3589112): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=8333 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404357.594335] type=1306 audit(1570434920.168:3589112): saddr=0A00C80B0000000000000000000000000000FFFF0A02011900000000
[404357.594338] type=1327 audit(1570434920.168:3589112): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404357.628207] type=1300 audit(1570434917.281:3589113): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404362.350168] audit_printk_skb: 822 callbacks suppressed
[404362.350172] type=1300 audit(1570434924.923:3589192): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404362.350180] type=1302 audit(1570434924.923:3589192): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404362.350183] type=1327 audit(1570434924.923:3589192): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404362.365125] type=1300 audit(1570434924.938:3589193): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404362.365135] type=1302 audit(1570434924.938:3589193): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404362.365138] type=1327 audit(1570434924.938:3589193): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404362.374116] type=1300 audit(1570434924.947:3589194): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404362.374124] type=1302 audit(1570434924.947:3589194): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404362.374141] type=1327 audit(1570434924.947:3589194): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404362.374543] type=1300 audit(1570434924.948:3589195): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404367.434899] audit_printk_skb: 288 callbacks suppressed
[404367.434904] type=1300 audit(1570434930.008:3589224): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=9016 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404367.434908] type=1306 audit(1570434930.008:3589224): saddr=0A00CBCA0000000000000000000000000000FFFF0A02011900000000
[404367.434911] type=1327 audit(1570434930.008:3589224): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404367.480842] type=1300 audit(1570434930.054:3589225): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=2522 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404367.480848] type=1306 audit(1570434930.054:3589225): saddr=0A00CBCD0000000000000000000000000000FFFF0A02011900000000
[404367.480851] type=1327 audit(1570434930.054:3589225): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404367.516792] type=1300 audit(1570434930.090:3589226): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=8333 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404367.516798] type=1306 audit(1570434930.090:3589226): saddr=0A00CBCF0000000000000000000000000000FFFF0A02011900000000
[404367.516802] type=1327 audit(1570434930.090:3589226): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404367.715842] type=1300 audit(1570434930.289:3589227): arch=c000003e syscall=41 success=yes exit=7 a0=2 a1=2 a2=0 a3=63 items=0 ppid=1 pid=5650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="vmtoolsd" exe="/usr/bin/vmtoolsd" key="pt_siem_api_socket"
[404372.557448] audit_printk_skb: 1014 callbacks suppressed
[404372.557452] type=1300 audit(1570434935.129:3589332): arch=c000003e syscall=257 success=yes exit=735 a0=ffffffffffffff9c a1=7f15d33b7a98 a2=90800 a3=0 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_home_read"
[404372.557461] type=1302 audit(1570434935.129:3589332): item=0 name="/home/usr1cv8/.1cv8/1C/1cv8/conf/" inode=524321 dev=08:21 mode=040755 ouid=997 ogid=1003 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404372.557465] type=1327 audit(1570434935.129:3589332): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404372.725239] type=1300 audit(1570434935.298:3589333): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=21249 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404372.725279] type=1306 audit(1570434935.298:3589333): saddr=0A00CDCE0000000000000000000000000000FFFF0A02011900000000
[404372.725286] type=1327 audit(1570434935.298:3589333): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404372.996917] type=1300 audit(1570434935.570:3589334): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404372.996928] type=1302 audit(1570434935.570:3589334): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404372.996932] type=1327 audit(1570434935.570:3589334): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404373.017640] type=1300 audit(1570434935.591:3589335): arch=c000003e syscall=2 success=yes exit=715 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404377.825045] audit_printk_skb: 417 callbacks suppressed
[404377.825049] type=1300 audit(1570434940.398:3589380): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=9016 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404377.825053] type=1306 audit(1570434940.398:3589380): saddr=0A00CFD50000000000000000000000000000FFFF0A02011900000000
[404377.825055] type=1327 audit(1570434940.398:3589380): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404377.861359] type=1300 audit(1570434940.434:3589381): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1250 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404377.861365] type=1306 audit(1570434940.434:3589381): saddr=0A00CFDC0000000000000000000000000000FFFF0A02011900000000
[404377.861368] type=1327 audit(1570434940.434:3589381): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404377.864022] type=1300 audit(1570434940.437:3589382): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=8333 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404377.864027] type=1306 audit(1570434940.437:3589382): saddr=0A00CFDE0000000000000000000000000000FFFF0A02011900000000
[404377.864030] type=1327 audit(1570434940.437:3589382): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404378.240991] type=1300 audit(1570434940.814:3589383): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1216 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404383.023626] audit_printk_skb: 768 callbacks suppressed
[404383.023631] type=1300 audit(1570434945.596:3589456): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=8333 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404383.023650] type=1306 audit(1570434945.596:3589456): saddr=0A00D2000000000000000000000000000000FFFF0A02011900000000
[404383.023654] type=1327 audit(1570434945.596:3589456): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404383.183878] type=1300 audit(1570434945.757:3589457): arch=c000003e syscall=2 success=yes exit=712 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404383.183888] type=1302 audit(1570434945.757:3589457): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404383.183892] type=1327 audit(1570434945.757:3589457): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404383.401020] type=1300 audit(1570434945.974:3589458): arch=c000003e syscall=2 success=yes exit=712 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404383.401030] type=1302 audit(1570434945.974:3589458): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404383.401034] type=1327 audit(1570434945.974:3589458): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404383.434759] type=1300 audit(1570434946.008:3589459): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=4872 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404388.223996] audit_printk_skb: 357 callbacks suppressed
[404388.224000] type=1300 audit(1570434950.797:3589500): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=4872 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404388.224004] type=1306 audit(1570434950.797:3589500): saddr=0A00D34B0000000000000000000000000000FFFF0A02011900000000
[404388.224007] type=1327 audit(1570434950.797:3589500): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404388.434212] type=1300 audit(1570434950.999:3589501): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=30931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404388.434221] type=1309 audit(1570434950.999:3589501): argc=3 a0="sh" a1="-c" a2="users"
[404388.434227] type=1302 audit(1570434950.999:3589501): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404388.434232] type=1302 audit(1570434950.999:3589501): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404388.434237] type=1327 audit(1570434950.999:3589501): proctitle=7368002D63007573657273
[404388.440900] type=1300 audit(1570434951.010:3589502): arch=c000003e syscall=59 success=yes exit=0 a0=ab3a30 a1=ab3d10 a2=ab2c30 a3=7ffeb4a767a0 items=2 ppid=12924 pid=30931 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="users" exe="/usr/bin/users" key="pt_siem_execve_root"
[404388.440909] type=1309 audit(1570434951.010:3589502): argc=1 a0="users"
[404393.558222] audit_printk_skb: 837 callbacks suppressed
[404393.558227] type=1300 audit(1570434956.131:3589585): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=9148 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404393.558232] type=1306 audit(1570434956.131:3589585): saddr=0A00D54E0000000000000000000000000000FFFF0A02011900000000
[404393.558234] type=1327 audit(1570434956.131:3589585): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404393.663985] type=1300 audit(1570434956.237:3589586): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=2522 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404393.663992] type=1306 audit(1570434956.237:3589586): saddr=0A00D5550000000000000000000000000000FFFF0A02011900000000
[404393.663995] type=1327 audit(1570434956.237:3589586): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404393.811323] type=1300 audit(1570434956.384:3589587): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=8333 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404393.811329] type=1306 audit(1570434956.384:3589587): saddr=0A00D55F0000000000000000000000000000FFFF0A02011900000000
[404393.811332] type=1327 audit(1570434956.384:3589587): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404394.125968] type=1300 audit(1570434956.699:3589588): arch=c000003e syscall=2 success=yes exit=712 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404398.689051] audit_printk_skb: 507 callbacks suppressed
[404398.689055] type=1300 audit(1570434961.262:3589647): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=7381 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404398.689059] type=1306 audit(1570434961.262:3589647): saddr=0A00A1800000000000000000000000000000FFFF0A02FD4200000000
[404398.689062] type=1327 audit(1570434961.262:3589647): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404398.965813] type=1300 audit(1570434961.538:3589648): arch=c000003e syscall=43 success=yes exit=5 a0=11 a1=7fb120001968 a2=7fb13db76c14 a3=1 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404398.965820] type=1306 audit(1570434961.538:3589648): saddr=0200F43D0A8F02410000000000000000
[404398.965823] type=1327 audit(1570434961.538:3589648): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404398.965863] type=1300 audit(1570434961.538:3589649): arch=c000003e syscall=43 success=no exit=-11 a0=11 a1=7fb11c005a58 a2=7fb13db76c14 a3=7fb13db76bb0 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404398.965867] type=1327 audit(1570434961.538:3589649): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404399.225348] type=1300 audit(1570434961.794:3589650): arch=c000003e syscall=59 success=yes exit=0 a0=7f48c42fef89 a1=7f48b0ff5b00 a2=7ffd7054f100 a3=7f48b0ff99d0 items=2 ppid=12760 pid=31004 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404399.225357] type=1309 audit(1570434961.794:3589650): argc=3 a0="sh" a1="-c" a2=2F6F70742F7365637265746E65742F7362696E2F756576656E742071756572792D786D6C20616C6C
[404403.767079] audit_printk_skb: 804 callbacks suppressed
[404403.767083] type=1300 audit(1570434966.339:3589729): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=7381 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404403.767087] type=1306 audit(1570434966.339:3589729): saddr=0A00D78A0000000000000000000000000000FFFF0A02011900000000
[404403.767090] type=1327 audit(1570434966.339:3589729): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404403.838385] type=1300 audit(1570434966.406:3589730): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=31043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404403.838393] type=1309 audit(1570434966.406:3589730): argc=3 a0="sh" a1="-c" a2="users"
[404403.838400] type=1302 audit(1570434966.406:3589730): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404403.838404] type=1302 audit(1570434966.406:3589730): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404403.838409] type=1327 audit(1570434966.406:3589730): proctitle=7368002D63007573657273
[404403.845484] type=1300 audit(1570434966.413:3589731): arch=c000003e syscall=59 success=yes exit=0 a0=1a3fa30 a1=1a3fd10 a2=1a3ec30 a3=7fff823d51e0 items=2 ppid=12924 pid=31043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="users" exe="/usr/bin/users" key="pt_siem_execve_root"
[404403.845502] type=1309 audit(1570434966.413:3589731): argc=1 a0="users"
[404408.831513] audit_printk_skb: 399 callbacks suppressed
[404408.831517] type=1300 audit(1570434971.403:3589775): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=21249 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404408.831521] type=1306 audit(1570434971.403:3589775): saddr=0A00D8CC0000000000000000000000000000FFFF0A02011900000000
[404408.831524] type=1327 audit(1570434971.403:3589775): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404408.834498] type=1300 audit(1570434971.406:3589776): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404408.834505] type=1322 audit(1570434971.406:3589776): pid=6121 cap_pi=0000000400000002 cap_pp=0000000400002c0f cap_pe=0000000400000002 cap_pa=0000000000000000
[404408.834507] type=1327 audit(1570434971.406:3589776): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[404408.834575] type=1300 audit(1570434971.406:3589777): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404408.834579] type=1322 audit(1570434971.406:3589777): pid=6121 cap_pi=0000000400000003 cap_pp=0000000400002c0f cap_pe=0000000400000003 cap_pa=0000000000000000
[404408.834582] type=1327 audit(1570434971.406:3589777): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[404408.834604] type=1300 audit(1570434971.406:3589778): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[404413.843683] audit_printk_skb: 1038 callbacks suppressed
[404413.843687] type=1300 audit(1570434976.415:3589880): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404413.843691] type=1306 audit(1570434976.415:3589880): saddr=020090CE0A02FD420000000000000000
[404413.843694] type=1327 audit(1570434976.415:3589880): proctitle=2F7573722F7362696E2F7A61626269785F6167656E74643A206C697374656E6572202331205B77616974696E6720666F7220636F6E6E656374696F6E5D
[404414.043018] type=1300 audit(1570434976.614:3589881): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1250 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404414.043024] type=1306 audit(1570434976.614:3589881): saddr=0A00DA650000000000000000000000000000FFFF0A02011900000000
[404414.043027] type=1327 audit(1570434976.614:3589881): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404414.095726] type=1300 audit(1570434976.667:3589882): arch=c000003e syscall=43 success=yes exit=5 a0=11 a1=7fb11c005a58 a2=7fb13db76c14 a3=1 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404414.095732] type=1306 audit(1570434976.667:3589882): saddr=0200F43E0A8F02410000000000000000
[404414.095736] type=1327 audit(1570434976.667:3589882): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404414.095761] type=1300 audit(1570434976.667:3589883): arch=c000003e syscall=43 success=no exit=-11 a0=11 a1=7fb11c006348 a2=7fb13db76c14 a3=7fb13db76bb0 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404419.028387] audit_printk_skb: 204 callbacks suppressed
[404419.028392] type=1300 audit(1570434981.597:3589904): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=31145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404419.028416] type=1309 audit(1570434981.597:3589904): argc=3 a0="sh" a1="-c" a2="users"
[404419.028423] type=1302 audit(1570434981.597:3589904): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404419.028428] type=1302 audit(1570434981.597:3589904): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404419.028433] type=1327 audit(1570434981.597:3589904): proctitle=7368002D63007573657273
[404419.036549] type=1300 audit(1570434981.604:3589905): arch=c000003e syscall=59 success=yes exit=0 a0=22d6a30 a1=22d6d10 a2=22d5c30 a3=7ffd4569c1a0 items=2 ppid=12924 pid=31145 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="users" exe="/usr/bin/users" key="pt_siem_execve_root"
[404419.036556] type=1309 audit(1570434981.604:3589905): argc=1 a0="users"
[404419.036562] type=1302 audit(1570434981.604:3589905): item=0 name="/usr/bin/users" inode=2099045 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404419.036567] type=1302 audit(1570434981.604:3589905): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404419.036570] type=1327 audit(1570434981.604:3589905): proctitle=7368002D63007573657273
[404424.124829] audit_printk_skb: 1161 callbacks suppressed
[404424.124833] type=1300 audit(1570434986.697:3590016): arch=c000003e syscall=43 success=yes exit=6 a0=4 a1=7ffe54877a10 a2=7ffe54877988 a3=0 items=0 ppid=13491 pid=13495 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" key="pt_siem_api_accept"
[404424.124837] type=1306 audit(1570434986.697:3590016): saddr=020095E00A02FD420000000000000000
[404424.124840] type=1327 audit(1570434986.697:3590016): proctitle=2F7573722F7362696E2F7A61626269785F6167656E74643A206C697374656E6572202332205B77616974696E6720666F7220636F6E6E656374696F6E5D
[404425.155299] type=1300 audit(1570434987.727:3590017): arch=c000003e syscall=288 success=yes exit=16 a0=4 a1=7ffdf2c3b630 a2=7ffdf2c3b610 a3=80000 items=0 ppid=6499 pid=1250 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_accept"
[404425.155305] type=1306 audit(1570434987.727:3590017): saddr=0A00DD6B0000000000000000000000000000FFFF0A02011900000000
[404425.155308] type=1327 audit(1570434987.727:3590017): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404425.162708] type=1300 audit(1570434987.734:3590018): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=31199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404425.162716] type=1309 audit(1570434987.734:3590018): argc=3 a0="sh" a1="-c" a2="users"
[404425.162722] type=1302 audit(1570434987.734:3590018): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404425.162727] type=1302 audit(1570434987.734:3590018): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404429.224198] audit_printk_skb: 381 callbacks suppressed
[404429.224220] type=1300 audit(1570434991.796:3590064): arch=c000003e syscall=43 success=yes exit=5 a0=11 a1=7fb11c006348 a2=7fb13d873c14 a3=1 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404429.224225] type=1306 audit(1570434991.796:3590064): saddr=0200F43F0A8F02410000000000000000
[404429.224228] type=1327 audit(1570434991.796:3590064): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404429.224256] type=1300 audit(1570434991.796:3590065): arch=c000003e syscall=43 success=no exit=-11 a0=11 a1=7fb124003748 a2=7fb13d873c14 a3=7fb13d873bb0 items=0 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_accept"
[404429.224259] type=1327 audit(1570434991.796:3590065): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404429.447631] type=1300 audit(1570434992.020:3590066): arch=c000003e syscall=257 success=yes exit=78 a0=ffffffffffffff9c a1=7fb0e800a988 a2=90800 a3=0 items=1 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_home_read"
[404429.447642] type=1302 audit(1570434992.020:3590066): item=0 name="/home/usr1cv8/.1cv8/1C/1cv8/conf/" inode=524321 dev=08:21 mode=040755 ouid=997 ogid=1003 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404429.447646] type=1327 audit(1570434992.020:3590066): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640064666134616265362D653862352D313165392D663038652D303035303536623631
[404429.447883] type=1300 audit(1570434992.020:3590067): arch=c000003e syscall=257 success=yes exit=78 a0=ffffffffffffff9c a1=7fb0e8016298 a2=90800 a3=0 items=1 ppid=1438 pid=23882 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_home_read"
[404429.447889] type=1302 audit(1570434992.020:3590067): item=0 name="/home/usr1cv8/.1cv8/1C/1cv8/conf/" inode=524321 dev=08:21 mode=040755 ouid=997 ogid=1003 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404434.269646] audit_printk_skb: 825 callbacks suppressed
[404434.269650] type=1300 audit(1570434996.840:3590148): arch=c000003e syscall=59 success=yes exit=0 a0=7ff1ba3e1f89 a1=7ff1a9ff85e0 a2=7ffc7280d180 a3=7ff1b47407f8 items=2 ppid=12924 pid=31262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" key="pt_siem_execve_root"
[404434.269656] type=1309 audit(1570434996.840:3590148): argc=3 a0="sh" a1="-c" a2="users"
[404434.269662] type=1302 audit(1570434996.840:3590148): item=0 name="/bin/sh" inode=2101960 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404434.269667] type=1302 audit(1570434996.840:3590148): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404434.269671] type=1327 audit(1570434996.840:3590148): proctitle=7368002D63007573657273
[404434.273829] type=1300 audit(1570434996.845:3590149): arch=c000003e syscall=59 success=yes exit=0 a0=166ea30 a1=166ed10 a2=166dc30 a3=7ffe6a199320 items=2 ppid=12924 pid=31262 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="users" exe="/usr/bin/users" key="pt_siem_execve_root"
[404434.273835] type=1309 audit(1570434996.845:3590149): argc=1 a0="users"
[404434.273840] type=1302 audit(1570434996.845:3590149): item=0 name="/usr/bin/users" inode=2099045 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404434.273845] type=1302 audit(1570434996.845:3590149): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404434.273848] type=1327 audit(1570434996.845:3590149): proctitle=7368002D63007573657273
[404439.526638] audit_printk_skb: 576 callbacks suppressed
[404439.526642] type=1131 audit(1570435002.099:3590213): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=httpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[404439.535830] type=1300 audit(1570435002.107:3590214): arch=c000003e syscall=59 success=yes exit=0 a0=560c98095560 a1=560c981307f0 a2=560c980b63c0 a3=2 items=2 ppid=1 pid=31302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_execve_root"
[404439.535838] type=1309 audit(1570435002.107:3590214): argc=2 a0="/usr/sbin/httpd" a1="-DFOREGROUND"
[404439.535844] type=1302 audit(1570435002.107:3590214): item=0 name="/usr/sbin/httpd" inode=2103857 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404439.535849] type=1302 audit(1570435002.107:3590214): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404439.535854] type=1327 audit(1570435002.107:3590214): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404439.625196] type=1300 audit(1570435002.197:3590215): arch=c000003e syscall=41 success=yes exit=3 a0=a a1=80002 a2=0 a3=100007fffff0000 items=0 ppid=1 pid=31302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_socket"
[404439.625203] type=1327 audit(1570435002.197:3590215): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404439.625267] type=1300 audit(1570435002.197:3590216): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=563804e9e430 a2=1c a3=100007fffff0000 items=0 ppid=1 pid=31302 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_connect"
[404439.625270] type=1306 audit(1570435002.197:3590216): saddr=0A000000000000000000000000000000000000000000000000000000
[404439.841984] systemd-journald[2949]: Received SIGTERM from PID 1 (systemd).
[404444.871413] audit_printk_skb: 2772 callbacks suppressed
[404444.871418] type=1300 audit(1570435007.443:3590516): arch=c000003e syscall=2 success=yes exit=86 a0=7f18a2afd4d2 a1=80000 a2=1b6 a3=24 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_user_read_sysconf_/etc/passwd"
[404444.871426] type=1302 audit(1570435007.443:3590516): item=0 name="/etc/passwd" inode=4457277 dev=08:21 mode=0100644 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404444.871429] type=1327 audit(1570435007.443:3590516): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404444.973604] type=1300 audit(1570435007.545:3590517): arch=c000003e syscall=41 success=yes exit=16 a0=2 a1=1 a2=6 a3=0 items=0 ppid=31302 pid=31376 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_socket"
[404444.973611] type=1327 audit(1570435007.545:3590517): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404444.973760] type=1300 audit(1570435007.545:3590518): arch=c000003e syscall=42 success=no exit=-115 a0=10 a1=5638052d83a0 a2=10 a3=0 items=0 ppid=31302 pid=31376 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="pt_siem_api_connect"
[404444.973763] type=1306 audit(1570435007.545:3590518): saddr=020006050A02982B0000000000000000
[404444.973766] type=1327 audit(1570435007.545:3590518): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
[404444.977984] type=1300 audit(1570435007.550:3590519): arch=c000003e syscall=43 success=yes exit=20 a0=c a1=7fab280061d8 a2=7fab36419c14 a3=1 items=0 ppid=1438 pid=1446 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rmngr" exe="/opt/1C/v8.3/x86_64/rmngr" key="pt_siem_api_accept"
[404444.977992] type=1306 audit(1570435007.550:3590519): saddr=0200DB7A0A02982B0000000000000000
[404450.062793] audit_printk_skb: 972 callbacks suppressed
[404450.062799] type=1300 audit(1570435012.634:3590624): arch=c000003e syscall=257 success=yes exit=91 a0=ffffffffffffff9c a1=7f17fff9b728 a2=90800 a3=0 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_home_read"
[404450.062808] type=1302 audit(1570435012.634:3590624): item=0 name="/home/usr1cv8/.1cv8/1C/1cv8/conf/" inode=524321 dev=08:21 mode=040755 ouid=997 ogid=1003 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404450.062812] type=1327 audit(1570435012.634:3590624): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404450.063147] type=1300 audit(1570435012.635:3590625): arch=c000003e syscall=257 success=yes exit=91 a0=ffffffffffffff9c a1=7f17fc25da48 a2=90800 a3=0 items=1 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_home_read"
[404450.063154] type=1302 audit(1570435012.635:3590625): item=0 name="/home/usr1cv8/.1cv8/1C/1cv8/conf/" inode=524321 dev=08:21 mode=040755 ouid=997 ogid=1003 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404450.063157] type=1327 audit(1570435012.635:3590625): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404450.064611] type=1300 audit(1570435012.636:3590626): arch=c000003e syscall=41 success=yes exit=91 a0=2 a1=1 a2=6 a3=2 items=0 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_socket"
[404450.064619] type=1327 audit(1570435012.636:3590626): proctitle=2F6F70742F31432F76382E332F7838365F36342F7270686F7374002D72616E676500313536303A31353931002D726567686F73740031632D70726F642D61707031332E6D6961632E6C616E002D726567706F72740031353431002D7069640036323636343132362D653636372D313165392D653539362D303035303536623631
[404450.064724] type=1300 audit(1570435012.636:3590627): arch=c000003e syscall=42 success=no exit=-115 a0=5b a1=7f174298aed0 a2=10 a3=5d9aefc4 items=0 ppid=1438 pid=6314 auid=1008 uid=997 gid=1003 euid=997 suid=997 fsuid=997 egid=1003 sgid=1003 fsgid=1003 tty=(none) ses=143 comm="rphost" exe="/opt/1C/v8.3/x86_64/rphost" key="pt_siem_api_connect"
[404450.064729] type=1306 audit(1570435012.636:3590627): saddr=02001FA50A0201190000000000000000
[404455.580366] audit_printk_skb: 795 callbacks suppressed
[404455.580370] type=1300 audit(1570435018.152:3590706): arch=c000003e syscall=59 success=yes exit=0 a0=8b0370 a1=8b0bc0 a2=890040 a3=7ffc92dd9be0 items=2 ppid=12548 pid=31534 auid=1006 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=21 comm="auditctl" exe="/usr/sbin/auditctl" key="pt_siem_execve_root"
[404455.580376] type=1309 audit(1570435018.152:3590706): argc=3 a0="auditctl" a1="-e" a2="0"
[404455.580382] type=1302 audit(1570435018.152:3590706): item=0 name="/sbin/auditctl" inode=2101551 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404455.580387] type=1302 audit(1570435018.152:3590706): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2097803 dev=08:21 mode=0100755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
[404455.580391] type=1327 audit(1570435018.152:3590706): proctitle=617564697463746C002D650030
[404455.582144] type=1305 audit(1570435018.154:3590707): audit_enabled=0 old=1 auid=1006 ses=21 res=1
[404455.649065] systemd-sysv-generator[31571]: [/etc/rc.d/init.d/cprocsp:4] PID file not absolute. Ignoring.
[404455.852121] systemd-sysv-generator[31600]: [/etc/rc.d/init.d/cprocsp:4] PID file not absolute. Ignoring.
[404456.093233] systemd-sysv-generator[31640]: [/etc/rc.d/init.d/cprocsp:4] PID file not absolute. Ignoring.
[1280503.925658] type=1305 audit(1571311068.673:3590708): audit_pid=970 old=0 auid=4294967295 ses=4294967295 res=1
[1360739.621703] type=1305 audit(1571391304.533:4590147): audit_pid=0 old=970 auid=4294967295 ses=4294967295 res=1
[1360739.626419] type=1300 audit(1571391304.541:4590148): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[1360739.626426] type=1322 audit(1571391304.541:4590148): pid=6121 cap_pi=0000000400000002 cap_pp=0000000400002c0f cap_pe=0000000400000002 cap_pa=0000000000000000
[1360739.626429] type=1327 audit(1571391304.541:4590148): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[1360739.631759] type=1300 audit(1571391304.547:4590149): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[1360739.631772] type=1322 audit(1571391304.547:4590149): pid=6121 cap_pi=0000000400000003 cap_pp=0000000400002c0f cap_pe=0000000400000003 cap_pa=0000000000000000
[1360739.631774] type=1327 audit(1571391304.547:4590149): proctitle="/opt/secretnet/sbin/snsyslog-ng"
[1360739.631800] type=1300 audit(1571391304.547:4590150): arch=c000003e syscall=126 success=yes exit=0 a0=23c16a4 a1=23c16ac a2=1 a3=7fffb0d2746c items=0 ppid=6120 pid=6121 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="snsyslog-ng" exe="/opt/secretnet/sbin/snsyslog-ng" key="pt_siem_api_caps"
[1360739.631804] type=1322 audit(1571391304.547:4590150): pid=6121 cap_pi=000000040000000b cap_pp=0000000400002c0f cap_pe=000000040000000b cap_pa=0000000000000000
[1360739.631806] type=1327 audit(1571391304.547:4590150): proctitle="/opt/secretnet/sbin/snsyslog-ng"