Anomalu detected rootkit

[Aj Navarro]

Anomaly detected in file '/etc/vx/.reclaim.lock'. Hidden from stats, but showing up on readdir. Possible kernel level rootkit.

 

What i need to check?

[Santiago Bassett]

Hi,

readdir and stat are two different system calls. OSSEC uses both to open your monitored files. In this case, what happens is that "stat" is not able to find the file, what is suspicious, as it could be found by" readdir".

Do you see the file if you do "ls -la /etc/vx/"?

What is the output of "stat /etc/vx/.reclaim.lock"? 

There are high chances that this is just a false positive. Shared file systems (possibly used by Veritas Backup in this case), use locking services to manage file access and to avoid conflicts during sessions. Is that file actually part of a shared file system? Maybe that is why it can't be read some times.

I hope it helps,

Santiago.

On Mon, May 23, 2016 at 12:54 PM, Aj Navarro <ajnava...@gmail.com> wrote:

Anomaly detected in file '/etc/vx/.reclaim.lock'. Hidden from stats, but showing up on readdir. Possible kernel level rootkit.

 

What i need to check?

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/25aaa3b5-8e6d-49cb-9b01-6a1074e8a7e7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.